Windows TCO Leftovers

posted by Roy Schestowitz on Jan 23, 2024

• BianLian Ransomware Group Strikes Again, Targeting Three U.S. Companies

  The BianLian ransomware group has claimed three new victims, adding them to their dark web portal. The targeted organizations include North Star Tax and Accounting, KC Pharmaceuticals, and Martinaire, all based in the United States. However, details regarding the extent of the BianLian ransomware attack, data compromise, and the motive behind the cyber assault remain undisclosed.

• Akira ransomware hits cloud service Tietoevry; numerous Swedish customers affected

  According to the Finland-based technology company’s statement on Monday, the attackers used the Akira ransomware-as-a-service tools. The incident was limited to “one part of one of our Swedish datacenters” and is believed to have only impacted services to some of Tietoevry's customers in Sweden.

• Ransomware Attack [sic] on IT Provider Downs Swedish Government Agencies, Schools, Companies

  The [breach] also affected retail chain Rusta, construction materials provider Moelven, a number of universities and colleges, as well as several government agencies and municipalities.

• Cyber attack [sic] against Tietoevry - cinemas and businesses affected

  Cinema chain Filmstaden, one of the businesses affected, has not been able to take online bookings or use its card machines, and is having to use Swish payments at their cinemas.

  Some regional authorities and municipal councils are also affected.

• [Cracker] attack against Swedish data centre knocks out cinema sales systems

  According to Swedish daily Aftonbladet , the cause is a ransomware attack against Tietoevry, but it remains unclear how long it will take to get systems up and running again.

  [...]

  "We do not have cash options, for example. But we are looking into all the possibilities if it were to drag on, which we really hope it doesn't.

• Ransomware Hit on Tietoevry Causes IT Outages Across Sweden

  Publicly traded Tietoevry, based in Espoo, Finland, said the [breach] began late Friday night or early on Saturday, hitting one of its Swedish data centers and resulting in outages for multiple Swedish customers.

  [...]

  Officials in Uppsala County, located on the east-central coast of Sweden, launched crisis management plans after the region's patient medical record system went offline and some financial systems became unavailable, warning that the situation could deteriorate unless the systems are restored quickly.

• Tietoevry, Finnish IT Giant, Hit by Cyberattack; Launches Probe

  Finnish IT services and enterprise cloud hosting provider Tietoevry has fallen victim to a ransomware attack, impacting cloud hosting customers in one of its data centers in Sweden. The Tietoevry cyberattack occurred during the night of Jan 19-20, affecting services for customers in Sweden.

  While overall Tietoevry cyberattack recovery efforts are underway, the severity of the situation persists.

• Australia imposes cyber sanctions on Russian it says ransomwared health insurer

  The 2022 incident saw Medibank attacked by ransomware, and data on around ten million customers leaked, some of it to the dark web. Stolen info included details of medical treatments undergone by around half a million Medibank Private customers. The names, dates of birth, addresses, phone numbers and email addresses of 9.7 million customers were also stolen.

• Atlassian Confluence Server RCE attacks underway from 600+ IPs

  As of Sunday more than 11,000 instances remain exposed on the [Internet], and criminals are pounding them with RCE attempts.

• LockBit Ransomware Group Expands Operations with New Cyberattack Victims

  The announcement on the dark web portal includes specific details about the targeted organizations. For TV Jahn Rheine, a company operating in the health, wellness, and fitness industry, the threat actor claims to have stolen a substantial amount of sensitive data, including accounting information, email conversations, and human resources records. The deadline for compliance with their demands is set for January 25, 2024, at 01:37:21 UTC.

• New NTLM Hash Leak Attacks Target Outlook, Windows Programs

  The new vulnerability is tracked as CVE-2023-35636. It has been assigned an ‘important’ severity rating by Microsoft, which fixed it with its December 2023 Patch Tuesday updates. The remaining issues have been assigned a ‘moderate’ severity rating and currently remain unpatched, Varonis said.