Weekly Update: 28 February 2023
Ransomware Rewind is a compilation of ransomware-related stories published over the past week.
Most Active Ransomware Operators
Volume of messages posted by operators during the last week.
Significant Campaigns & Incidents
Documents and discussion of significant ransomware campaigns, incidents, and associated actors.
Oregon City server outage caused by ‘sophisticated ransomware attack,’ officials sayOregonian – Feb 28 2023 02:19
U.S. Marshals Service investigating ransomware attack, data theftBleepingComputer.com – Feb 28 2023 00:48
Minneapolis Public Schools still investigating what caused ‘encryption event’The Record by Recorded Future – Feb 27 2023 20:46
Dish multi-day outage rolls on as ransomware fears growThe Register Security – Feb 27 2023 20:30
Ransomware attack on food giant Dole Food Company blocked North America productionSecurity Affairs – Feb 26 2023 19:01
Ohio’s largest oil producer says ‘no impact’ seen after cyberattackThe Record by Recorded Future – Feb 24 2023 16:16
Mallox Group Claims Ransomware Attack on FICCICyble Blog – Feb 24 2023 06:52
Ransomware gang leaked Los Angeles student health records onlineReuters – Feb 23 2023 18:23
Report: Mysterious ‘Nevada Group’ Launches Mass Ransomware AttackPYMNTS.com – Feb 23 2023 13:32
Indigo admits cyber attack was ransomware, employee data accessedIT World Canada – Feb 23 2023 00:16
Washington State city allegedly hit by ransomwareDataBreaches.net – Feb 22 2023 12:11
Porsche South Africa victim of ransomware attackBusiness Tech Africa – Feb 22 2023 08:49
BlackCat Hackers Denied Ransom in Attack on Leigh Valley Health NetworkBitdefender – Feb 21 2023 12:24
Tactics & Techniques
Discussion and mentions of significant techniques deployed by threat actors.
CrowdStrike: More Cybercriminals Ditching Ransomware To Focus On Data ExtortionCRN – Feb 27 2023 23:12
Healthcare Organizations Warned About MedusaLocker Ransomware AttacksHIPAA Journal – Feb 27 2023 15:34
Hackers Extort Less Money, Are Laid Off as New Tactics Thwart More Ransomware AttacksDataBreaches.net – Feb 26 2023 19:10
Authorities Warn Healthcare Sector of Ongoing Clop ThreatsBankInfoSecurity – Feb 24 2023 23:39
Threat Actors Weaponize Old Bugs to Launch Ransomware AttacksCyware – Feb 24 2023 18:43
Magniber Ransomware’s Relaunch TechniqueASEC Blog AhnLab English – Feb 23 2023 23:10
PureCrypter targets government entities through DiscordMenlo Security – Feb 23 2023 14:26
Royal Mail schools LockBit in leaked negotiationMalwarebytes Unpacked – Feb 23 2023 13:00
Trellix Finds LockBit Ransomware Gang Most Apt to Leak Stolen DataYahoo! News – Feb 22 2023 05:05
Researcher Analysis
Analysis, deep-dives and reverse engineering.
New Research: In Asia-Pacific Region, Willingness to Pay Ransomware Attackers Varies by CountryProofPoint – Feb 28 2023 00:46
New Exfiltrator-22 post-exploitation kit linked to LockBit ransomwareBleeping Computer – Feb 27 2023 20:14
A Deep Dive into the Evolution of Ransomware Part 3Trend Micro Research News Perspectives – Feb 27 2023 19:51
A Deep Dive into the Evolution of Ransomware Part 2Trend Micro – Feb 24 2023 00:00
A tale of Phobos – how we almost cracked a ransomware using CUDACERT Polska – Feb 23 2023 11:00
Understanding Ransomware Using Data ScienceTrend Micro Security News – Feb 23 2023 10:52
Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023Security Intelligence – Feb 22 2023 03:40
A Deep Dive into the Evolution of Ransomware Part 1Trend Micro Simply Security – Feb 21 2023 18:39
LockBit, BlackCat, and Royal Dominate the Ransomware Scene: Ransomware in Q4 2022Trend Micro – Feb 21 2023 13:27
Legal Actions and Discussion
Actions, consequences, and policy discussion by governments and organisations.
Bitdefender Releases Decryptor for MortalKombat RansomwareBitdefender Labs – Feb 28 2023 14:00
“Ethical hacker” amongst those arrested in Dutch ransomware investigationBitdefender – Feb 27 2023 15:34
CISA leader tells MSPs cyber insurance market ‘rise in ransomware’Biz.Crast.net – Feb 25 2023 08:45
5 Lawsuits Filed in Ransomware Breach Affecting 3.3 MillionDeviceSecurity.io – Feb 22 2023 22:22
True Health New Mexico data breach class action settlementTop Class Actions – Feb 22 2023 18:30
CentraState Medical Center Facing Class Action Lawsuit Over December 2022 Ransomware AttackHIPAA Journal – Feb 22 2023 14:53
The content in this report was compiled by the use of our award-winning intelligence product Silobreaker Online. Silobreaker cannot guarantee the accuracy, completeness, integrity or quality of any content in this report and no responsibility is accepted by Silobreaker in respect of such content. Readers must determine for themselves what reliance they should place on the compiled content in the report.
