Weekly Update: 09 May 2023
Ransomware Rewind is a compilation of ransomware-related stories published over the past week.
Most Active Ransomware Operators
Volume of messages posted by operators during the last week.
Significant Campaigns & Incidents
Documents and discussion of significant ransomware campaigns, incidents, and associated actors.
Intel investigating leak of Intel Boot Guard private keys after MSI breachBleepingComputer.com – May 08 2023 17:31
Vocalcom Ransomware Attack, Credit Card Sales, and Botnet ServicesSOCRadar – May 08 2023 12:15
Western Digital Confirms Ransomware Group Stole Customer InformationSecurityWeek – May 08 2023 09:00
Constellation Struck By Ransomware Attack, ALPHV Lays ClaimInformation Security Buzz – May 05 2023 17:20
Meade Tractor Cyber Attack: After Black Basta, Royal Ransomware Targets CompanyThe Cyber Express – May 05 2023 08:26
Ransomware gang hijacks university alert system to issue threatsBleepingComputer.com – May 04 2023 15:21
Unwelcome guest: Trigona ransomware group claims they’ve taken up residence in Unique Imaging’s networkDataBreaches.net – May 04 2023 14:11
Hacker with a Heart of Gold: Ransomware Gang Apologises After Targeting SchoolIT Governance Blog – May 04 2023 14:02
Medusa ransomware group starts leaking data from Crown Princess Mary Cancer Centre; threatens to leak moreDataBreaches.net – May 04 2023 13:11
City of Dallas hit by Royal ransomware attack impacting IT servicesBleepingComputer.com – May 03 2023 22:13
Italian water supplier serving 500,000 people hit with ransomware attackRecord by Recorded Future – May 03 2023 19:52
Brightline data breach impacts 783K pediatric mental health patientsBleepingComputer.com – May 03 2023 14:33
60 Companies Targeted by LockBit, Group Threatens to Leak Data SoonThe Cyber Express – May 03 2023 10:53
Montana State University Ransomware Attack, Hackers Steal Over 100GB DataThe Cyber Express – May 02 2023 10:16
Medusa ransomware gang leaks students’ psychological reports and abuse allegationsBitdefender – May 02 2023 07:50
Tactics & Techniques
Discussion and mentions of significant techniques deployed by threat actors.
Creative Ransomware Extortion; Further Malware Capabilities With ChatGPTEclecticIQ Blog – May 09 2023 08:00
New Cactus ransomware encrypts itself to evade antivirusBleeping Computer – May 07 2023 16:47
New Extortion Tactics Used to Force Ransomware PaymentsSpearTip Blog – May 04 2023 14:32
CERT-In issues cyber alert against ‘Royal’ ransomware that attacks health, education sectorsCERT-EU News – May 04 2023 10:28
Polish Healthcare Industry Targeted by Vidar Infostealer Likely Linked to Djvu RansomwareEclecticIQ Blog – May 02 2023 14:19
Researcher Analysis
Analysis, deep-dives and reverse engineering.
Meet Akira — A new ransomware operation targeting the enterpriseBleeping Computer – May 07 2023 13:47
BlackBit Ransomware: A Threat from the Shadows of LokiLockerCyble Blog – May 03 2023 12:32
GoAnywhere MFT Vulnerability Contributes to 91% Increase in Ransomware AttacksSOCRadar – May 03 2023 11:18
Netskope Threat Coverage: CrossLock RansomwareNetskope Threat Labs – May 02 2023 18:50
Dark Web Profile: BlackByte RansomwareSOCRadar – May 02 2023 13:57
Legal Actions and Discussion
Actions, consequences, and policy discussion by governments and organisations.
As ransomware data remain ‘fuzzy,’ US cyber leaders see reasons for optimismRecord by Recorded Future – May 08 2023 12:41
$1.1M Paid to Resolve Ransomware Attack on California CountySecurityWeek – May 08 2023 10:30
Neuberger: Counter Ransomware Initiative focused on ‘expanding the tent,’ with Jordan, Costa Rica, Columbia joiningRecord by Recorded Future – May 08 2023 01:56
Ransomware watchers are finding creative ways to track attacksSC Magazine US – May 05 2023 23:26
2 Years After Colonial Pipeline, US Critical Infrastructure Still Not Ready for RansomwareDark Reading: – May 05 2023 14:00
The key to making the US cyber strategy work: boots on the groundCyberscoop News – May 04 2023 19:24
Court Rules in Favor of Merck in $1.4 Billion Insurance Claim Over NotPetya CyberattackSecurityWeek – May 03 2023 15:49
FBI seizes 9 crypto exchanges used to launder ransomware paymentsBleepingComputer.com – May 02 2023 19:52
The content in this report was compiled by the use of our award-winning intelligence product Silobreaker Online. Silobreaker cannot guarantee the accuracy, completeness, integrity or quality of any content in this report and no responsibility is accepted by Silobreaker in respect of such content. Readers must determine for themselves what reliance they should place on the compiled content in the report.
