Talos Takes Ep. #67: What a leaked playbook tells us about the Conti ransomware group

By Jon Munshaw. The latest episode of Talos Takes is available now. Download this episode and subscribe to Talos Takes using the buttons below, or visit the Talos Takes page. There's a lot to take apart in the recently leaked Conti ransomware playbook. After a disgruntled member of the... This is...

Conti ransomware affiliates hit Exchange Servers with ProxyShell exploits

By Waqas Conti ransomware affiliates are exploiting 3 unpatched vulnerabilities that allow unauthenticated, remote code execution on MS Exchange Servers. This is a post from HackRead.com Read the original post: Conti ransomware affiliates hit Exchange Servers with ProxyShell exploits...

Translated: Talos' insights from the recently leaked Conti ransomware playbook

By Caitlin Huey, David Liebenberg, Azim Khodjibaev, and Dmytro Korzhevin. Executive summary Cisco Talos recently became aware of a leaked playbook that has been attributed to the ransomware-as-a-service RaaS group Conti. Talos has a team of dedicated, native-level speakers that translated these...

LockFile Ransomware Bypasses Protection Using Intermittent File Encryption

A new ransomware family that emerged last month comes with its own bag of tricks to bypass ransomware protection by leveraging a novel technique called "intermittent encryption." Called LockFile, the operators of the ransomware have been found exploiting recently disclosed flaws such as ProxyShel...

ProxyShell and PetitPotam exploits weaponized by LockFile Ransomware Group

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. LockFile, a new ransomware gang, has been active since last week. LockFile began by using a publicly disclosed PetitPotam exploit CVE-2021-36942 to compromise Windows Domain Controllers earlier this week. Using ProxyShell...

Ransomware turncoat leaks Conti data, lifts the lid on the ransomware business

Last week, The Record broke the news that a self-described "pen tester" for the infamous Conti ransomware gang, who goes by the handle m1Geelka, had leaked manuals, technical guides, and software on the underground forum XSS. According to the screenshot of m1Geelkas original forum post—and...

Someone pubished Conti ransomware gang’s sensitive insider data online

By Sudais Asif The member who goes by the username of “m1Geelka” expressed resentment on the notion that recruited hackers are not paid reasonably by the Conti ransomware gang. This is a post from HackRead.com Read the original post: Someone pubished Conti ransomware gangs sensitive insider data...

Angry Affiliate Leaks Conti Ransomware Gang Playbook

An apparently vengeful affiliate of the Conti Gang has leaked the playbook of the ransomware group after alleging that the notorious cybercriminal organization underpaid him for doing its dirty work. A security researcher shared a comment from an online forum allegedly posted by someone who did...

Tracking Malware and Ransomware Domains in 2021

In 2021, the threat of ransomware has loomed large. In many ways, it’s exactly what cybersecurity experts expected and predicted after the major cyber attacks of 2020—including hospital ransomware attacks on a healthcare industry hard-hit by both ransomware and Covid-19. But in other ways, this...

TrickBot Botnet Found Deploying A New Ransomware Called Diavol

Threat actors behind the infamous TrickBot malware have been linked to a new ransomware strain named "Diavol," according to the latest research. Diavol and Conti ransomware payloads were deployed on different systems in a case of an unsuccessful attack targeting one of its customers earlier this...

[Webinar] How Cyber Attack Groups Are Spinning a Larger Ransomware Web

Organizations today already have an overwhelming number of dangers and threats to look out for, from spam to phishing attempts to new infiltration and ransomware tactics. There is no chance to rest, since attack groups are constantly looking for more effective means of infiltrating and infecting...

This Week in Security News June 25, 2021

Fake DarkSide campaign targets energy and food sectors and Tulsa police-citation data leaked by Conti Gang...

Tulsa’s Police-Citation Data Leaked by Conti Gang

The city of Tulsa, OK is asking some of its residents to keep a close eye on their personal and financial accounts after the Conti ransomware group leaked some 18,000 city files, mostly police citations, on the dark web. The leak stemmed from a May 6 ransomware attack that caused the city to shut...

Threat spotlight: Conti, the ransomware used in the HSE healthcare attack

On the 14th of May, the Health Service Executive HSE, Ireland’s publicly funded healthcare system, fell victim to a Conti ransomware attack, forcing the organization to shut down more than 80,000 affected endpoints and plunging them back to the age of pen and paper. This happened a week after...

FBI Warns Conti Ransomware Hit 16 U.S. Health and Emergency Services

The adversary behind Conti ransomware targeted no fewer than 16 healthcare and first responder networks in the U.S. within the past year, totally victimizing over 400 organizations worldwide, 290 of which are situated in the country. That's according to a new flash alert issued by the U.S. Federa...

Unsuccessful Conti Ransomware Attack Still Packs Costly Punch

Ireland’s department of health services continues to grapple with a ransomware attack that occurred last week by the Conti gang. Officials state the attack will cost tens of millions to repair, even though attackers were not successful in their attempt to encrypt systems on Ireland’s Department o...

Conti ransomware gang demanded $40m from US school district

By Habiba Rashid Broward County Schools district in Fort Lauderdale, FL was attacked by the infamous Conti ransomware group last month. In a series of ransomware attacks on educational institutions that have been going on for the past few weeks, this time around, Broward County Public Schools in...

Conti Gang Demands $40M Ransom from Florida School District

UPDATE The Conti Gang has demanded a $40 million ransom from a Fort Lauderdale, Fla., school district after a ransomware attack last month. Attackers stole personal information from students and teachers, disrupted the district’s networks, and caused some services to be unavailable. The incident...

Trend Micro Vision One: Tracking Conti Ransomware

We show how the Trend Micro Vision One platform can be used to track Conti ransomware...

Ransomware Profitability

Analyzing cryptocurrency data, a research group has estimated a lower-bound on 2020 ransomware revenue: $350 million, four times more than in 2019. Based on the companys data, among last years top earners, there were groups like Ryuk, Maze now-defunct, Doppelpaymer, Netwalker disrupted by...