Weekly Update: 11 April 2023
Ransomware Rewind is a compilation of ransomware-related stories published over the past week.
Most Active Ransomware Operators
Volume of messages posted by operators during the last week.
Significant Campaigns & Incidents
Documents and discussion of significant ransomware campaigns, incidents, and associated actors.
Yum Brands Discloses Data Breach Following Ransomware AttackSecurityWeek – Apr 11 2023 10:19
New Jersey county police department confirms ransomware attack, unrelated to attack on prosecutor’s officeDataBreaches.net – Apr 11 2023 01:10
Black Basta ransomware group extorts Capita with stolen customer data, Capita fumble response.DoublePulsar Medium – Apr 09 2023 08:08
Notorious Medusa ransomware: Gang seeks $500,000 from GMDCTimes of India – Apr 09 2023 02:44
PharMerica and BrightSpring Health Services hit by Money MessageDataBreaches.net – Apr 08 2023 14:40
MSI confirms security breach following ransomware attack claimsBleeping Computer – Apr 07 2023 16:47
7×7 Dental Implant & Oral Surgery alleged victim of Abyss ransomware groupDataBreaches.net – Apr 07 2023 14:10
Hackers leak 16,000 Tas documents on dark webDataBreaches.net – Apr 07 2023 11:40
Medusa ransomware claims attack on Open University of CyprusBleeping Computer – Apr 06 2023 16:14
UK criminal records office suffers two-month “cyber security incident”ITPro.com – Apr 05 2023 19:47
Illinois’s Olympia CUSD 16 hit by LockBit3.0DataBreaches.net – Apr 05 2023 17:11
UnitedLex hit by d0nut ransomware team, 200 GB of corporate files leakedDataBreaches.net – Apr 04 2023 22:40
Tactics & Techniques
Discussion and mentions of significant techniques deployed by threat actors.
Ransomware Groups Using Heinous Tactics to Extort VictimsSpearTip Blog – Apr 10 2023 14:30
Data breaches get dangerously personalBarracuda Networks – Apr 10 2023 12:21
Iran-Based Hackers Caught Carrying Out Destructive Attacks Under Ransomware GuiseThe Hacker News – Apr 08 2023 07:19
Fake Data Theft Proof Leads to Royal Ransomware OutbreakBankInfoSecurity – Apr 04 2023 18:10
Researcher Analysis
Analysis, deep-dives and reverse engineering.
WalkThrough of Wanna Cry RansomwareInfoSec Bug Bounty Write-ups – Apr 10 2023 09:22
FusionCore – An Emerging Malware-as-a-Service Group in EuropeCyware – Apr 09 2023 19:58
New Cylance Ransomware with Power-Packed CommandLine OptionsCyble Blog – Apr 07 2023 07:43
Demystifying Money Message RansomwareCyble Blog – Apr 06 2023 14:18
Clop Ransomware Leak Site Shows Increased ActivityDell SecureWorks Blog – Apr 05 2023 00:00
Read our new blog post to get a comprehensive description of the #BabLock attack: their toolset, the strain’s samples for Windows, ESXi, and Linux as well as the group’s TTPs:
#ransomware
GroupIB_GIB Twitter – Apr 04 2023 19:38Legal Actions and Discussion
Actions, consequences, and policy discussion by governments and organisations.
Microsoft, Fortra are this fed up with cyber-gangs abusing Cobalt StrikeTheRegister.com – Apr 10 2023 16:33
Insurance can make crime more difficult, costly, and unprofitable, as seen in the kidnap for ransom market. This report by Anja Shortland, @keatingetom and @jamiemaccoll
explores whether cyber insurance can do the same for ransomware.RUSI_org Twitter – Apr 10 2023 15:13
explores whether cyber insurance can do the same for ransomware.RUSI_org Twitter – Apr 10 2023 15:13
Veritas Vulnerabilities Exploited in Ransomware Attacks Added to CISA ‘Must Patch’ ListSecurity Week – Apr 10 2023 14:52
Rackspace awaits judge’s decision in class-action case filed over ransomware attack falloutSan Antonio Express-News.com – Apr 07 2023 16:16
Do cyber regulations actually make K–12 schools safer? Navigating compliance while securing school and student dataMalwarebytes Unpacked – Apr 06 2023 03:00
IDCARE warns new privacy laws could exacerbate ransomware attacksIT News Australia – Apr 06 2023 02:20
Singapore pushes greater action against ransomware gangs after Optus data hackABC Top Stories – Apr 05 2023 20:00
Cracking down on ransomware with military-grade defencesTechNative – Apr 05 2023 06:04
The content in this report was compiled by the use of our award-winning intelligence product Silobreaker Online. Silobreaker cannot guarantee the accuracy, completeness, integrity or quality of any content in this report and no responsibility is accepted by Silobreaker in respect of such content. Readers must determine for themselves what reliance they should place on the compiled content in the report.
