John Schlager’s Post

CL0P's Ransomware Rampage - Security Measures for 2024. 2023 CL0P Growth  Emerging in early 2019, CL0P was first introduced as a more advanced version of its predecessor the ‘CryptoMix’ ransomware, brought about by its owner CL0P ransomware, a cybercrime organisation. Over the years the group remained active with significant campaigns throughout 2020 to 2022. But in 2023 the CL0P ransomware gang took itself to new heights and became one of the http://ow.ly/HEGW105oWo5 #InceptusSecure #UnderOurProtection

CL0P's Ransomware Rampage - Security Measures for 2024: 2023 CL0P Growth  Emerging in early 2019, CL0P was first introduced as a more advanced version of its predecessor the ‘CryptoMix’ ransomware, brought about by its owner CL0P ransomware, a cybercrime organisation. Over the years the group remained active with significant campaigns throughout 2020 to 2022. But in 2023 the CL0P ransomware gang took itself to new heights and became one of the https://lnkd.in/gKqNcaEU

SEXi Ransomware Rebrands as 'APT Inc.,' Keeps Old Methods The cybercrime group demands ransoms of varying degrees, from thousands to even millions of dollars — in some cases, 2 #bitcoin per #encrypted customer. #SEXi #ransomware group, a #cybercrime group that has targeted a variety of organizations in attacks that started in February of this year, has been operating under the name of #APT Inc. since June. https://lnkd.in/eDH3UUMy #cybernews #cybersecurity

Tune into the webinar where our very own threat experts present the Q1 ransomware landscape in depth!

Ampito Group have a number of solutions to reduce your risk of becoming a victim. To discuss what options are available and how we can support you, then get in touch gcunnah@ampito.com #ransomware #humanfirewall #cybersecurity

#Cyberthreats What's Phobos malware? Phobos is a ransomware that locks or encrypts files to demand a ransom. It uses AES encryption which leaves no chance to recover the infected files. Phobos ransomware first surfaced in late 2017 with many researchers quickly discovering links between Phobos and the Dharma and CrySiS ransomware variants. The Phobos ransomware operators are known to primarily target small- to medium-sized businesses (including healthcare entities such as hospitals) and typically demand lower ransom amounts compared to other ransomware families. Read more about Phobos at https://lnkd.in/ezeVmMNf #threats #malware #Phobos #Ransomware

Check out my most recent article with Colin Cowie on a Threat Activity Cluster (TAC) that Sophos has observed transitioning from Vice Society ransomware to Rhysida ransomware. It's a great example of our efforts to track ransomware-as-a-service (RaaS) affiliate behavior and contains some actionable intel on the TTPs that we consistently observed throughout the intrusions. https://lnkd.in/ehqjMG5e

8Base Group Deploying New Phobos Ransomware Variant via #unique SmokeLoader. The threat actors behind the 8Base ransomware are leveraging a variant of the Phobos ransomware to conduct their financially motivated attacks. The findings come from Cisco Talos, which has recorded an increase in activity carried out by cybercriminals. "Most of the group's Phobos variants are distributed by SmokeLoader, a backdoor trojan," "This commodity loader typically drops or downloads additional payloads when deployed. In 8Base campaigns, however, it has the ransomware component embedded in its encrypted payloads, which is then decrypted and loaded into the SmokeLoader process' memory."

Why are offsite immutable backups crucial? In 2023, 24% of #DestructiveAttacks involved ransomware. The average cost of a #RansomwareAttack was $5.13 million—up 13% from 2022. It’s more important than ever for your organization’s backups to be immutable and unencryptable by ransomware. Don't lose access to your own data: https://ow.ly/kj9e50QnuAn. #ImmutableBackup #DataProtection #Ransomware #RansomwarePrevention

Although cryptographic #ransomware is the most common and successful type of ransomware, it is not the only one. It’s important to remember that ransomware is not a single family of malware but is a criminal business model in which malware is used to hold something of value for ransom.