Ransomware Archives - s0x • Austin Managed IT Services

8 Mar, 2022

Conti Ransomware Group Diaries, Part IV: Cryptocrime

Cybersecurity Athens University School of Information Sciences and Technolog, Begemot, Bloodrush, Chainalysis, Conti ransomware, DDoS, Demon, Ghost, Gizmodo, Jeffrey Ladish, Mango, Matt Novak, Ne'er-Do-Well News, pump-and-dump, Ransomware, Russia's War on Ukraine, SQUID, Stern, Van

Three stories here last week pored over several years’ worth of internal chat records stolen from the Conti ransomware group, the most profitable ransomware gang in operation today. The candid messages revealed how Conti evaded law enforcement and intelligence agencies, what it was like on a typical day at the Conti office, and how Conti secured the digital weaponry used in their attacks. This final post on the Conti conversations explores different schemes that Conti pursued to invest in and steal cryptocurrencies. …

4 Mar, 2022

Conti Ransomware Group Diaries, Part III: Weaponry

Cybersecurity A Little Sunshine, alarm, Bentley, Bio, Bloodrush, Chainalysis, Cobalt Strike, Conti, Grant, Kaktus, LeMans Corporation, Ne'er-Do-Well News, PIN, Ransomware, Reshaev, Revers, Salamandra, Skippy, The Spaniard, Tramp, Trickbotleaks, trump

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it’s like to be an employee of Conti’s sprawling organization. Today’s Part III looks at how Conti abused a panoply of popular commercial security services to undermine the security of their targets, as well as how the team’s leaders strategized for the upper hand in ransom negotiations with victims. …

2 Mar, 2022

Conti Ransomware Group Diaries, Part II: The Office

Cybersecurity A Little Sunshine, Bentley, Bleeping Computer, Conti, Emotet, Hof, Lawrence Abrams, Mango, Ne'er-Do-Well News, Palo Alto Networks, Ransomware, Reverse, Ryuk, Stern, The Coming Storm, trickbot

Earlier this week, a Ukrainian security researcher leaked almost two years’ worth of internal chat logs from Conti, one of the more rapacious and ruthless ransomware gangs in operation today. Tuesday’s story examined how Conti dealt with its own internal breaches and attacks from private security firms and governments. In Part II of this series we’ll explore what it’s like to work for Conti, as described by the Conti employees themselves. …

1 Mar, 2022

Conti Ransomware Group Diaries, Part I: Evasion

Cybersecurity alex holden, Alla Witte, Conti, Conti breach, Conti ransomware, Contileaks, Emercoin, EmerDNS, Hof, Hold Security, Ne'er-Do-Well News, Ransomware, REvil ransomware, Stern, The Coming Storm, trickbot, Ukraine

A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti, an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. The chat logs offer a fascinating glimpse into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. The records also provide insight into how Conti has dealt with its own internal breaches and attacks from private security firms and foreign governments. …

16 Feb, 2022

Red Cross Hack Linked to Iranian Influence Operation?

Cybersecurity Data Breaches, fbi, FireEye, ICRC hack, International Committee for the Red Cross, KELA, [email protected], Ne'er-Do-Well News, RaidForums, Ransomware, Red Cross and Red Crescent Movement, Restoring Family Links, Sheriff, threat_actor, unindicted

A network intrusion at the International Committee for the Red Cross (ICRC) in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran. …

14 Feb, 2022

Wazawaka Goes Waka Waka

Cybersecurity A Little Sunshine, Babuk, Babuk ransomware, Biba99, Boriselcin, Cisco Talos, CVE-2021-20028, Dmitry Smilyanets, Groove ransom, Mikhail Pavlovich Matveev, Ne'er-Do-Well News, Orange, RaidForums, RAMP, Ransomware, SonicWall VPN, [email protected], ToX, Verified, Washington Metropolitan Police Department, Wazawaka

In January, KrebsOnSecurity examined clues left behind by “Wazawaka,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since “lost his mind” according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists. In last month’s story, we explored clues that led from Wazawaka’s multitude of monikers, email addresses, and passwords to a 30-something father in Abakan, Russia named Mikhail Pavlovich Matveev. This post concerns itself with the other half of Wazawaka’s identities not mentioned in the first story, such as how Wazawaka also ran the Babuk ransomware affiliate program, and later became “Orange,” the founder of the ransomware-focused Dark Web forum known as “RAMP.” …

At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates

Cybersecurity Andrey Sergeevich Bessonov, Colonial Pipeline, DarkSide, Dmitri Alperovitch, FSB, GandCrab, Immersive Labs, Kevin Breen, Ne'er-Do-Well News, NotPetya, President Biden, Ransomware, rEvil, Roman Gennadyevich Muromsky, The Coming Storm, Vladimir Putin

The Russian government said today it arrested 14 people accused of working for “REvil,” a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin’s decision to station 100,000 troops along the nation’s border with Ukraine. …

12 Jan, 2022

Who is the Network Access Broker ‘Wazawaka?’

Cybersecurity 902228, Abakan, Abaza, Breadcrumbs, Constella Intelligence, cs-arena.org, DarkSide, ddosis.ru, [email protected], domaintools, Flashpoint, initial access broker, Kopyovo-a, LockBit, Mikhail Matveev, Mikhail Mix Matveev, [email protected], [email protected], Ne'er-Do-Well News, Ransomware, Uhodiransomware, Wazawaka

In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene. …

14 Dec, 2021

Kronos Cloud hit by ransomware attack and warns of data breach

Cloud cyber attack, Industries, Kronos, Log4j, privacy, Ransomware, Security, UKG

14 Dec, 2021

Inside Ireland’s Public Healthcare Ransomware Scare

Cybersecurity A Little Sunshine, Conti ransomware, Data Breaches, H-ISAC, Health Service Executive, HSE, Ireland, PriceWaterhouseCoopers, Ransomware, Ryuk

The accounting firm PricewatersCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland’s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousand of outdated Windows 7 systems, and that the health system’s IT administrators failed to respond to multiple warning signs that a massive attack was imminent. …

s0x • Austin Managed IT Services

s0x • Austin Managed IT Services

Tag Archives: Ransomware