FBI and FinCEN Release Advisory on AvosLocker Ransomware

The Federal Bureau of Investigation FBI and the Department of the Treasury’s Financial Crimes Enforcement Network FinCEN have released a joint Cybersecurity Advisory identifying indicators of compromise associated with AvosLocker ransomware. AvosLocker is a ransomware-as-a-service affiliate-based...

AvosLocker ransomware uses Microsoft Exchange Server vulnerabilities, says FBI

The FBI has issued an advisory about the AvosLocker ransomware. Notably the FBI has noticed that several victims have reported Microsoft Exchange Server vulnerabilities as the intrusion vector. AvosLocker is a Ransomware as a Service RaaS affiliate-based group that has targeted victims across...

A week in security (March 14 – 20)

Last week on Malwarebytes Labs: Beware of this bogus and phishy “Instagram Support” email Meet Exotic Lily, access broker for ransomware and other malware peddlers Double header: IsaacWiper and CaddyWiper How to protect RDP Online Safety Bill’s provisions for “legal but harmful” content described...

Agencies Warn on Satellite Hacks & GPS Jamming Affecting Airplanes, Critical Infrastructure

In a warning to aviation authorities and air operators on Thursday, the European Union Aviation Safety Agency EASA warned of satellite jamming and spoofing attacks across a broad swath of Eastern Europe that could affect air navigation systems. The warning came in tandem with a separate alert fro...

Targeting Satellite? CISA, FBI Warns of Attacks on SATCOM Network Providers

By Deeba Ahmed This advisory comes amid an investigation spearheaded by investigation teams from the US and Europe regarding service outages… This is a post from HackRead.com Read the original post: Targeting Satellite? CISA, FBI Warns of Attacks on SATCOM Network Providers...

FBI catches up with one of its Most Wanted, arrests head of advance-fee crime network

Some dont mind putting extra effort into making their crime appear as legitimate as possible by perpetuating more lies as long as they are guaranteed money in the end. Osondu Victor Igwilo is one such Nigerian scammer. The "catchers" 52-year-old Igwilo has been on the Federal Bureau of...

Strengthening Cybersecurity of SATCOM Network Providers and Customers

CISA and the Federal Bureau of Investigation FBI are aware of possible threats to U.S. and international satellite communications SATCOM networks. Successful intrusions into SATCOM networks could create additional risk for SATCOM network customer environments. In response, CISA and FBI have...

FBI, CISA Warn of Russian Hackers Exploiting MFA and PrintNightmare Bug

The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI have released a joint advisory warning that Russia-backed threat actors hacked the network of an unnamed non-governmental entity by exploiting a combination of flaws. "As early as May 2021,...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

52 Critical Infrastructure Orgs Hit by Ragnar Locker Ransomware Gang – FBI

By Deeba Ahmed According to the FBIs advisory, Ragnar Locker ransomware operators have targeted ten different sectors including energy, manufacturing, government,… This is a post from HackRead.com Read the original post: 52 Critical Infrastructure Orgs Hit by Ragnar Locker Ransomware Gang - FBI...

RagnarLocker ransomware gang breached 52 critical infrastructure organizations

In a FLASH publication issued by the FBI in coordination with DHS/CISA, the FBI says it has identified at least 52 organizations across 10 critical infrastructure sectors affected by RagnarLocker ransomware, including organizations in the critical manufacturing, energy, financial services,...

Updated: Conti Ransomware

CISA, the Federal Bureau of Investigation FBI, the National Security Agency NSA, and the United States Secret Service USSS have re-released an advisory on Conti ransomware. Conti cyber threat actors remain active and reported Conti ransomware attacks against U.S. and international organizations...

FBI Releases Indicators of Compromise for RagnarLocker Ransomware

The Federal Bureau of Investigation FBI has released a Flash report detailing indicators of compromise IOCs associated with ransomware attacks by RagnarLocker, a group of a ransomware actors targeting critical infrastructure sectors. CISA encourages users and administrators to review the IOCs and...

Broadcom Software Discloses APT Actors Deploying Daxin Malware in Global Espionage Campaign

Broadcom Software—an industry member of CISA’s Joint Cyber Defense Collaborative JCDC—uncovers an advanced persistent threat APT campaign against select governments and other critical infrastructure targets in a publication titled Daxin: Stealthy Backdoor Designed for Attacks Against Hardened...

Analysis and Protections for RagnarLocker Ransomware

Trellix Global Defenders: Analysis and Protections for RagnarLocker Ransomware By Taylor Mullins · February 28, 2022 The United States Federal Bureau of Investigation FBI has released a Flash Alert warning that the RagnarLocker ransomware gang has breached the networks of at least fifty-two...

Analysis and Protections for RagnarLocker Ransomware

Trellix Global Defenders: Analysis and Protections for RagnarLocker Ransomware By Taylor Mullins · February 28, 2022 The United States Federal Bureau of Investigation FBI has released a Flash Alert warning that the RagnarLocker ransomware gang has breached the networks of at least fifty-two...

Microsoft Exchange Server Bugs Exploited by ‘Cuba’ Ransomware Gang

The ransomware gang known as “Cuba” is increasingly shifting to exploiting Microsoft Exchange vulnerabilities – including ProxyShell and ProxyLogon – as initial infection vectors, researchers have found. The group has likely been prying open these chinks in victims’ armor as early as last August,...

Iran's MuddyWater Hacker Group Using New Malware in Worldwide Cyber Attacks

Cybersecurity agencies from the U.K. and the U.S. have laid bare a new malware used by the Iranian government-sponsored advanced persistent threat APT group in attacks targeting government and commercial networks worldwide. "MuddyWater actors are positioned both to provide stolen data and accesse...

Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks

Summary Actions to Take Today to Protect Against Malicious Activity Search for indicators of compromise. Use antivirus software. Patch all systems. Prioritize patching known exploited vulnerabilities. Train users to recognize and report phishing attempts. Use multi-factor authentication. Note: th...

New Sandworm Malware Cyclops Blink Replaces VPNFilter

Summary The Sandworm actor, which the United Kingdom and the United States have previously attributed to the Russian GRU, has replaced the exposed VPNFilter malware with a new more advanced framework. The United Kingdom's UK National Cyber Security Centre NCSC, the Cybersecurity and Infrastructur...