August 22, 2022

Greece’s largest natural gas distributor suffers a data breach and disruptions following an attack by the Ragnar Locker ransomware gang

On Saturday 20th of August 2022, Greece’s largest natural gas distributor, DESFA released a statement confirming that they suffered a data breach and IT system outage following a cyberattack. Although due to the quick response of its IT team, the intrusion was limited. However, some files and data were accessed and could be possibly exfiltrated so there is the risk […]
August 22, 2022

LockBit’s data leak sites shut down from DDoS attack, LockBit blames Entrust for attacks

Over the weekend of the 20th of August 2022, the LockBit ransomware operation’s data leak sites have been shut down due to a DDoS attack in response to LockBit claiming responsibility for the cyberattack against Entrust that occurred in July. LockBit started to leak data that was allegedly stolen from Entrust, including legal documents, marketing spreadsheets, and accounting data. Shortly […]
August 17, 2022

BlackByte ransomware gang returns with new extortion tactics

The BlackByte ransomware operation has returned with version 2.0 of their operation which introduces a new data leak site utilizing new extortion techniques borrowed from LockBit. Since their return, the BlackByte ransomware operation has been promoting a new data leak site on hacker forums and through Twitter accounts the threat actor seems to be controlling. At the time of writing, […]
August 16, 2022

Clop ransomware group attacked UK water supplier but extorted the wrong company

On Monday 15th of August 2022, South Staffordshire confirmed that they had experienced IT disruption from a cyberattack. The released announcement explained that the safety and water distribution systems are still operational and therefore there is no impact on the supply of safe water to its customers or those of its subsidiaries, Cambridge Water and South Staffs Water. “This is […]
August 15, 2022

PLAY ransomware hits Argentina’s Judiciary of Córdoba

On Saturday 13th of August 2022, Argentina’s Judiciary of Córdoba experienced a ransomware attack that resulted in them having to shut down its IT systems. The shutdown also resulted in the use of pen and paper for submitting official documents. Argentina’s Judiciary of Córdoba has confirmed they were hit by ransomware and have engaged with Microsoft, Cisco, Trend Micro, and […]
August 11, 2022

FBI releases joint cybersecurity advisory against Zeppelin ransomware

On Thursday 11th of August 2022, the United States Federal Bureau of Investigation (FBI) released a joint TLP:WHITE cybersecurity advisory which revealed threat actors have been using the Zeppelin ransomware from 2019 through to at least June 2022 where a wide range of businesses and critical infrastructure organisations have been targeted, including defence contractors, educational institutions, manufacturers, technology companies, and […]
August 10, 2022

Cisco confirms attack by Yanluowang ransomware gang

On Wednesday 10th of August 2022, Cisco confirmed the Yanluowang ransomware group had breached its corporate network in late May and that the ransomware group tried to extort them under the threat of leaking stolen files online. Although Cisco confirmed that the incident had no impact on their business operations. This confirmation was released in a response to the Yanluowang […]
August 10, 2022

7-Eleven Denmark confirms store closures as a result of a ransomware attack

On Monday 8th of August 2022, 7-Eleven Denmark experienced a ransomware attack that resulted in the closure of 175 stores across Denmark as they were not able to accept payment or use their cash register. The incident was confirmed via a statement on Facebook. “This is a so-called ransomware attack, where the criminals have forced access to the network and […]
August 6, 2022

New GwisinLocker ransomware can target and encrypt Windows and Linux ESXi servers

This week, cybersecurity researchers at Ahnlab and ReversingLabs released reports on the new ransomware family called ‘GwisinLocker’ which has been seen targetting South Korean healthcare, industrial, and pharmaceutical companies with Windows and Linux encryptors. The reports also highlighted that these encryptors have support for encrypting VMware ESXi servers and virtual machines as well as using AES symmetric-key encryption with SHA256 […]
Prev page
1234567891011121314151617181920212223242526272829
Next page

Collaboration can mitigate the effects of Ransomware Attacks

Archives
Categories
Privacy Policy
RSS NCSC Threat Reports Feed

© 2021 CyberEnsō – Nihon Cyber Defence Co., Ltd. All Rights Reserved.