February 29, 2024

A North Korean-linked APT group exploited a zero-day vulnerability in the Windows AppLocker driver (appid.sys) to gain kernel-level access to a target system

An APT group linked to North Korea is exploiting a zero-day vulnerability in the appid.sys AppLocker driver using an admin-to-kernel exploit. A zero-day exploit, identified as CVE-2024-21338, was addressed by Microsoft in February. The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. In the AppLocker application, this driver controls which apps and files […]
February 29, 2024

Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware

At least two different suspected China-linked cyber espionage clusters, tracked as UNC5325 and UNC3886, have been attributed to the exploitation of security flaws in Ivanti Connect Secure VPN appliances. CVE-2024-21893 is actively exploited. As part of the attack chain, CVE-2024-21893 is combined with a previously disclosed command injection vulnerability tracked as CVE-2024-21887 to gain unauthorized access to vulnerable devices. In […]
June 8, 2023

MOVEit extortion attacks claimed by Clop ransomware gang

The Clop ransomware gang has confirmed that they are behind the MOVEit Transfer attacks where they have been exploiting a zero-day vulnerability to breach servers belonging to “hundreds of companies” and steal data. It has been revealed that the gang had started exploiting the vulnerability on Saturday 27th of May 2023, during the US Memorial Day holiday. At this time, the […]
June 1, 2023

2.5 million individuals impacted following ransomware against Harvard Pilgrim Health Care

Last week, Harvard Pilgrim Health Care (HPHC), a Massachusetts-based non-profit health services provider released a data breach notice disclosing that a ransomware attack it suffered in April 2023 impacted 2,550,922 people, as well as the threat actors stealing their sensitive data from compromised systems. The notice revealed that the threat actors had maintained access to HPHC’s systems between March 28 […]
May 17, 2023

New MalasLocker ransomware demands charity donation after targeting Zimbra servers

This week, a new ransomware operation, dubbed MalasLocker by BleepingComputer, has been observed which is targeting Zimbra servers to steal emails and encrypt files since the end of March 2023. Although instead of demanding a ransom payment, the threat actors claim to require a donation to charity to provide an encryptor and prevent data leaking. “Unlike traditional ransomware groups, we’re […]
May 17, 2023

FBI releases joint advisory against the BianLian ransomware gang

On Tuesday 16th of May 2023, the United States Federal Bureau of Investigation (FBI) released a joint TLP:CLEAR cybersecurity advisory warning organisations of the latest tactics, techniques, and procedures (TTPs) used by the BianLian ransomware group. The advisory highlighted that BianLian is a ransomware developer, deployer, and data extortion cybercriminal group that has targeted organisations in multiple U.S. critical infrastructure sectors […]
May 17, 2023

ScanSource warns of delays following ransomware attack

On Tuesday 16th of May 2023, a US-based technology provider ScanSource disclosed that they had suffered a ransomware attack that has impacted some of its systems, business operations, and customer portals. The impact has been significant, as it is expected to cause delays in the provision of services to customers in North America and Brazil. ScanSource has stated in a press […]
May 15, 2023

Cisco Talos reveals RA Group ransomware targeting USA and South Korean organisations

On Monday 15th of May 2023, Cisco Talos revealed a new ransomware group named ‘RA Group’ that is targeting pharmaceutical, insurance, wealth management, and manufacturing firms in the United States and South Korea. The blog post covering the group revealed that their operation started in April 2023, when they launched a data leak site on the dark web on Sunday […]
May 15, 2023

Data of 5.8 million PharMerica patients stolen by ransomware gang

On Friday 12th of May 2023, a US-based pharmacy services provider PharMerica disclosed that they had suffered a data breach involving the personal information of over 5.8 million patients. According to a data breach notification, the threat actors breached PharMerica’s system on Sunday 12th of March 2023 and stole the full names, addresses, dates of birth, social security numbers (SSNs), medications, […]
Prev page
12345678910111213141516171819
Next page

Collaboration can mitigate the effects of Ransomware Attacks

Archives
Categories
Privacy Policy
RSS NCSC Threat Reports Feed

© 2021 CyberEnsō – Nihon Cyber Defence Co., Ltd. All Rights Reserved.