Ransomware Articles

July 14, 2024

4TB of internaal date allegedly leaked in Austrailan medical research breach

The Medusa ransomware group has claimed responsibility for stealing over four terabytes of data from the Harry Perkins Institute of Medical Research in Western Australia. The group posted on its dark web leak site, stating that 4.6TB of internal building camera recordings had been uploaded. Medusa is demanding a ransom of US$500,000, though it is also willing to sell the […]

July 4, 2024

Attack Cases Against HTTP File Server (HFS) (CVE-2024-23692)

Researchers have discovered ongoing exploitation of a critical vulnerability in the HTTP File Server (HFS) that is being used to deploy cryptocurrency mining malware, Remote Access Trojans (RATs), backdoors, and infostealers.This vulnerability, identified as CVE-2024-23692, impacts the Rejetto HTTP File Server (HFS), a software that enables file sharing through a web browser using only an executable file, bypassing the need […]

June 25, 2024

DarkGate Malware Replaces AutoIt with AutoHotkey in Latest Cyber Attacks

Cyber attacks involving the DarkGate malware-as-a-service (MaaS) operation have transitioned from using AutoIt scripts to an AutoHotkey mechanism for the final stages of the attack, highlighting the threat actors’ ongoing efforts to evade detection.These updates were observed in DarkGate version 6, released in March 2024 by its developer, RastaFarEye, who has been offering the program on a subscription basis to […]

June 20, 2024

Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools

Ransomware activity increased in 2023 compared to 2022, according to Google-owned Mandiant.This is despite broadscale law enforcement operations against prominent ransomware groups, including ALPHV/BlackCat. In 2023, Mandiant noted a rise in ransomware activity, reflected by more posts on data leak sites and a moderate increase in ransomware investigations. Around a third of new ransomware families were variants of existing ones. […]

May 12, 2024

IntelBroker Hacker Claims Breach of Top Cybersecurity Firm, Selling Access

The notorious and somewhat high-profile hacker going by the pseudonym “IntelBroker” has claimed to have successfully breached one of the largest cybersecurity companies in the world.The hacker, believed to be from Serbia, has a reputation for targeting major organizations across industries like government, telecommunications, automotive, and tech. Known as the operator of the Endurance ransomware, IntelBroker has taken credit for […]

May 5, 2024

North Korea hacking teams hack South Korea defence contractors – police

North Korean hacking groups have targeted defense contractors in South Korea, according to police reports. The attackers were identified through an analysis of source IP addresses, signal re-routing structures, and malware signatures. Authorities, in collaboration with national intelligence agencies and private sector experts, traced the hacks back to these groups.The Hacking teams linked to North Korea’s intelligence apparatus and known […]

April 11, 2024

Threat Actors Are Actively Using Pupy RAT Malware to Attack Linux Systems

A number of cyberattacks have been observed targeting Linux systems in Asian campaigns through the use of the Pupy Remote Access Trojan (RAT). The Pupy RAT’s intricate capabilities, including remote command execution, information theft, keylogging, and its ability to evade detection, make it a valuable tool for cybercriminals seeking to compromise and infiltrate systems in Asia region. In order to […]

March 14, 2024

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

AndroxGh0st is a Python-based malware designed to target Laravel applications. It scans and extracts critical information from .env files, revealing login details for AWS and Twilio. As an SMTP cracker, it exploits SMTP using various strategies, including credential exploitation, web shell deployment, and vulnerability scanning. The ability of the program to generate AWS suggests the possibility of brute force attacks. […]

March 14, 2024

DarkGate Malware Leveraged Newly Patched Microsoft Vulnerability in Zero-Day Exploit

An underground campaign called Dark Gate was discovered by the Zero Day Initiative (ZDI) in mid-January 2024 that exploited CVE-2024-21412 by using fake software installers. As part of this campaign, users were lured by PDFs that contained Google DoubleClick Digital Marketing (DDM) open redirects, causing them to navigate to compromised websites that contained the malicious Microsoft Windows SmartScreen bypass CVE-2024-21412 […]

4TB of internaal date allegedly leaked in Austrailan medical research breach

Attack Cases Against HTTP File Server (HFS) (CVE-2024-23692)

DarkGate Malware Replaces AutoIt with AutoHotkey in Latest Cyber Attacks

Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools

IntelBroker Hacker Claims Breach of Top Cybersecurity Firm, Selling Access

North Korea hacking teams hack South Korea defence contractors – police

Threat Actors Are Actively Using Pupy RAT Malware to Attack Linux Systems

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

DarkGate Malware Leveraged Newly Patched Microsoft Vulnerability in Zero-Day Exploit

Collaboration can mitigate the effects of Ransomware Attacks

Archives

Categories

Privacy Policy

Privacy Policy

NCSC Threat Reports Feed