John Schlager’s Post

Medusa Ransomware on the Rise: From Data Leaks to Multi-Extortion. The threat actors associated with the Medusa ransomware have ramped up their activities following the debut of a dedicated data leak site on the dark web in February 2023 to publish sensitive data of victims who are unwilling to agree to their demands. “As part of their multi-extortion strategy, this group will provide victims with multiple options when their data is posted on their http://ow.ly/2cCp1058BQ8 #InceptusSecure #UnderOurProtection

The RansomHouse group, identified as a Ransomware-as-a-Service (RaaS), emerged in late 2021 and has been active in deploying ransomware variants to exploit corporate networks. The group extorts its victims twice, first by encrypting their files and demanding a ransom, and second by naming and shaming non-paying victims on their blog, along with which they publish the stolen data from the victim. Their tactics, techniques, and procedures (TTPs) show a mature and sophisticated level of execution, leveraging content delivery network (CDN) servers for exfiltration, and utilizing a Tor-based chat room for victim negotiations.  (24TTPs with 'Procedure' level details on the TruKno blog). #trukno #mitreattack #threathunting #threatdetection #cyberattack #ciso #threatintel #threatintelligence #cybersecurity #infosec #malwarehunting #malwareanalysis #malware #ThreatAnalyst https://lnkd.in/gEFSdRJu

The RansomHouse group, identified as a Ransomware-as-a-Service (RaaS), emerged in late 2021 and has been active in deploying ransomware variants to exploit corporate networks. The group extorts its victims twice, first by encrypting their files and demanding a ransom, and second by naming and shaming non-paying victims on their blog, along with which they publish the stolen data from the victim. Their tactics, techniques, and procedures (TTPs) show a mature and sophisticated level of execution, leveraging content delivery network (CDN) servers for exfiltration, and utilizing a Tor-based chat room for victim negotiations.  (24TTPs with 'Procedure' level details on the TruKno blog). #trukno #mitreattack #threathunting #threatdetection #cyberattack #ciso #threatintel #threatintelligence #cybersecurity #infosec #malwarehunting #malwareanalysis #malware #ThreatAnalyst

The RansomHouse group, identified as a Ransomware-as-a-Service (RaaS), emerged in late 2021 and has been active in deploying ransomware variants to exploit corporate networks. The group extorts its victims twice, first by encrypting their files and demanding a ransom, and second by naming and shaming non-paying victims on their blog, along with which they publish the stolen data from the victim. Their tactics, techniques, and procedures (TTPs) show a mature and sophisticated level of execution, leveraging content delivery network (CDN) servers for exfiltration, and utilizing a Tor-based chat room for victim negotiations.  (24TTPs with 'Procedure' level details on the TruKno blog). #trukno #mitreattack #threathunting #threatdetection #cyberattack #ciso #threatintel #threatintelligence #cybersecurity #infosec #malwarehunting #malwareanalysis #malware #ThreatAnalyst

23 new ransomware groups vs. 25 new ransomware groups. Similar, right? Except 23 ransomware groups were created in the whole of 2023 and 25 have been created since the beginning of 2024 and we are only in the middle of Q2. The Cyberint research team has been following this trend closely and has released a report detailing the developments: https://hubs.la/Q02y8-7V0

📆 🚩 Does ransomware really have an expiry date? 👉 https://lnkd.in/euCpT8gk 👈 🖥️ In the sixth episode of our Raven Call series, we sat down with Christopher McGrath, a Senior Board Advisor of PRODAFT. In this episode, we discussed the future of traditional ransomware and cybercrime developments we forecast based on the current buildout. ⏰ Additionally, looking back at the timeline of Operation Cronos and analyzing the response from the #LOCKBIT ransomware gang as one of the prime examples, this episode touched upon a variety of topics: 🔹 the main difference between CTI and CI  🔸 how should organizations approach ransom payments 🔹 how are cybercrime models going to interchange over time 🔸 how the insurance sector gets affected by ransomware attacks  🔹 why are affiliates such a popular concept in the ransomware circles  🔸 how to build stronger resilience & the importance of public-private partnerships  📢 Eager to hear more? Then get comfortable and watch the new episode on our #YouTube channel! #RavenCall #theRavenCallSeries #cybersecurity #webinar #ransomware #cyberawareness

Since 2019, BGH adversaries have threatened to publish stolen data on DLSs as a secondary extortion means in concert with deploying ransomware.12 In 2023, adversaries continued to invent exploitation methods to steal victim data and increase pressure on victims, with many — including GRACEFUL SPIDER and MASKED SPIDER — adopting data theft as their sole means of extortion. Learn more about these adversaries, and others, by reserving a copy of CrowdStrike's 2024 Global Threat Report: https://lnkd.in/gU2BAaNU

Join tomorrow’s live LockBit threat briefing!

THIS JUST IN: (last 24 hours) RansomHub / DragonForce / Play / LockBit RansomHub ransomware group has added 3 new victims to their darkweb portal. Panitc////////////////LLP, CM/////// Inc. and Millinocket //////////////. Certi/////////// has fallen victim to the DragonForce ransomware. The group claims to have accessed 40.37 GB of the organizations data and intends to publish it within 6-7 days. Play Ransomware and LockBit allegedly just created an alliance. The alleged agreement involves a $35,000 payment by Play Ransomware for tools. They will also get training from LockBit. A 2024 study by Stanford University found that human error is responsible for 88% of all data breaches. That is why for over 10 years we have been offering a NO COST Public Service Initiative (PSI) for cyber-security awareness training. Its professional training for your team with some excellent take home resources and there is absolutely No Sales Pitch.  Would it be ridiculous to take 15 minutes to hear more about this? #breachavoidance #threatmitigation

Since 2019, BGH adversaries have threatened to publish stolen data on DLSs as a secondary extortion means in concert with deploying ransomware.12 In 2023, adversaries continued to invent exploitation methods to steal victim data and increase pressure on victims, with many — including GRACEFUL SPIDER and MASKED SPIDER — adopting data theft as their sole means of extortion. Learn more about these adversaries, and others, by reserving a copy of CrowdStrike's 2024 Global Threat Report: https://lnkd.in/g3BADNmc