REvil Used 0-Day in Kaseya Ransomware Attack, Demands $70 Million Ransom

Amidst the massive supply-chain ransomware attack that triggered an infection chain compromising thousands of businesses on Friday, new details have emerged about how the notorious Russia-linked REvil cybercrime gang may have pulled off the unprecedented hack. The Dutch Institute for Vulnerabilit...

Tracking Cobalt Strike: A Trend Micro Vision One Investigation

Cobalt Strike is a well-known beacon or post-exploitation tool that has been linked to several ransomware campaigns. This report focuses on the process of uncovering its tracks in order to fully contain and remove a malware infection...

How REvil Ransomware Took Out Thousands of Business at Once

More details have come to light as to how the notorious hacking group pulled off its unprecedented attack...

CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack

CISA and the Federal Bureau of Investigation FBI continue to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers MSPs and their customers. CISA and FBI strongly urge affected MSPs and their customers to...

IT Management Platform Kaseya Hit With Sodinokibi/REvil Ransomware Attack

Kaseya has been hit with a REvil aka Sodinokibi ransomware attack at the dawn of the Fourth of July weekend. The attack was geared toward their on-premises VSA product...

REvil Ransomware targets 1000+ businesses causing holiday havoc

By Sudais Asif REvil ransomware gang was revealed to have attacked at least 40 Managed Service Providers MSPs through Kaseya. Here's what happened. This is a post from HackRead.com Read the original post: REvil Ransomware targets 1000+ businesses causing holiday havoc...

Kaseya Supply-Chain Attack Hits Nearly 40 Service Providers With REvil Ransomware

Threat actors behind the notorious REvil cybercrime operation appear to have pushed ransomware via an update for Kaseya's IT management software, hitting around 40 customers worldwide, in what's an instance of a widespread supply-chain ransomware attack. "Beginning around mid-day EST/US on Friday...

A New Kind of Ransomware Tsunami Hits Hundreds of Companies

An apparent supply chain attack exploited Kaseya's IT management software to encrypt a "monumental" number of victims all at once...

UPDATED: Kaseya hijacked, thousands attacked by REvil, fix delayed again

Malwarebytes does not use Kaseya products. Malwarebytes detects the REvil ransomware used in this attack as Sodinokibi. Latest updates July 7, 8:30 am, Kaseya VSA SaaS platform still offline, not updated as planned July 6, 3:40 pm, malspam using fake Kaseya security update July 6, 3:15 am,...

TrickBot Spruces Up Its Banking Trojan Module

The TrickBot trojan is adding man-in-the-browser MitB capabilities for stealing online banking credentials that resemble Zeus, the early banking trojan, researchers said — potentially signaling a coming onslaught of fraud attacks. TrickBot is a sophisticated and common modular threat known for...

Why Healthcare Keeps Falling Prey to Ransomware and Other Cyberattacks

The healthcare industry is under attack like never before. What started as a surge in criminal activity during the early days of the coronavirus pandemic has now metastasized into a full-blown crisis within the healthcare industry worldwide. The recent disruptive ransomware attacks on Scripps...

Ransomware. In the air?

Introduction As an exercise, we were asked to look at the potential vectors for ransomware to affect flight despatch and operations. In most cases, flight systems simply werent significantly exposed, but ground systems affected by ransomware may make flight ops either impossible or significantly...

Kaseya VSA Supply-Chain Ransomware Attack

CISA is taking action to understand and address the recent supply-chain ransomware attack against Kaseya VSA and the multiple managed service providers MSPs that employ VSA software. CISA encourages organizations to review the Kaseya advisory and immediately follow their guidance to shutdown VSA...

This Week in Security News July 2, 2021

Nefilim ransomware attack through a MITRE Att lens and PoC exploit circulating for critical Windows Print Spooler bug, and more...

Linux Variant of REvil Ransomware Targets VMware’s ESXi, NAS Devices

UPDATE Cybercriminals behind a string of high-profile ransomware attacks, including one extorting $11 million from JBS Foods last month, have ported their malware code to the Linux operating system. The unusual move is an attempt to target VMware’s ESXi virtual machine management software and...

Spanish telecom giant MasMovil hit by Revil ransomware gang

By Waqas Revil ransomware gang is claiming to have downloaded databases and other important data belonging to the MasMovil group. This is a post from HackRead.com Read the original post: Spanish telecom giant MasMovil hit by Revil ransomware gang...

Defeating Ransomware-as-a-Service? Think Intel-Sharing

The Colonial Pipeline ransomware attack put a glaring spotlight on the ransomware scourge – and, in particular, on the rise of ransomware-as-a-service RaaS. That attack was perpetrated by DarkSide, a RaaS platform that purportedly first surfaced last August. While the group now claims they’re don...

Insurance and Ransomware

As ransomware becomes more common, Im seeing more discussions about the ethics of paying the ransom. Heres one more contribution to that issue: a research paper that the insurance industry is hurting more than its helping. However, the most pressing challenge currently facing the industry is...

Babuk Ransomware Builder Mysteriously Appears in VirusTotal

The Babuk ransomware gang’s source code has been uploaded to VirusTotal, making it available to all security vendors and competitors. It’s unclear however just how that happened. According to a Wednesday posting from Malwarebytes, the operators of the ransomware – perhaps best-known for hitting t...

3 Steps to Strengthen Your Ransomware Defenses

The recent tsunami of ransomware has brought to life the fears of downtime and data loss cybersecurity pros have warned about, as attacks on the energy sector, food supply chain, healthcare industry, and other critical infrastructure have grabbed headlines. For the industry experts who track the...