Windows TCO: Ransomware, Data Breach, and More
-
The Register UK ☛ Ransomware gangs invest in custom data stealing malware
In a report published on Wednesday by Cisco Talos, the threat intelligence unit reviewed the top 14 ransomware groups and analyzed their tactics, techniques and procedures (TTPs). Talos selected the 14 based on volume and impact of attacks and "atypical threat actor behavior," using data from the criminals' leak sites, internal tracking, and other open-source reporting.
The 14, listed here by number of victims on their respective shaming sites, are the ones you'd likely expect: LockBit, ALPHV, Play, 8base, BlackBasta, BianLian, CLOP, Cactus, Medusa, Royal/Blacksuit, Rhysida, Hunters International, Akira, and Trigona.
-
Cyble Inc ☛ Neiman Marcus Data Breach: Celebrities Targeted?
In its notification filed with the Attorney General of Maine on June 24, the company claimed that the breach affected an estimated 64,472 victims. However, the threat actor, operating under the pseudonym “Sp1d3rHunters,” claimed that the group was downplaying the breach and alleged that they had illegal access to a database of 40 million customers, which included high-profile celebrities.
-
Threat Source ☛ Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
Given the recent slate of massive ransomware attacks that have disrupted everything from hospitals to car dealerships, Cisco Talos wanted to take a renewed look at the top ransomware players to see where the current landscape stands.
Based on a comprehensive review of more than a dozen prominent ransomware groups, we identified several commonalities in tactics, techniques and procedures (TTPs), along with several notable differences and outliers.
-
Cyble Inc ☛ Evolve Bank Ransomware Attack Claims 7.64 Million Victims
LockBit, a Russian-speaking ransomware-as-a-service (RaaS) group, claimed responsibility for the attack. Interestingly, LockBit initially attributed the stolen data to the Federal Reserve, likely due to a stolen document referencing the central bank.
-
Air Force Times ☛ Russian [intruders] infiltrate Veterans Affairs via Microsoft account
The Russian state-sponsored [cracker] infiltrated a Microsoft platform called Microsoft Azure Government, which provides storage, databases and other services to the VA and other government agencies.