Ransomware Archives - CyberConvoy Blog

Critical Infrastructure Organizations Warned of BianLian Ransomware Attacks

The gang has been observed gaining access to victim networks via remote desktop protocol (RDP) credentials that were likely acquired from initial access brokers or via phishing attacks

17 May

Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers

These add too many other unique, non-Babuk-based ransomware strains targeting VMware ESXi virtual machines discovered in the wild for several years

13 May

New Cactus ransomware encrypts itself to evade antivirus

Researchers found that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances

8 May

Linux version of RTM Locker ransomware targets VMware ESXi servers

Ransomware operations have followed this trend and created Linux encryptors dedicated to targeting ESXi servers to encrypt all data used by the enterprise properly

29 April

Microsoft SQL servers hacked to deploy Trigona ransomware

The MS-SQL servers are being breached via brute-force or dictionary attacks that take advantage of easy-to-guess account credentials

19 April

LockBit Ransomware Now Targeting Apple macOS Devices

Threat actors behind the LockBit ransomware operation have developed new artifacts that encrypt files on devices running Apple's macOS operating system

19 April

QBot Expands Initial Access Malware Strategy With PDF-WSF Combo

Qbot's use of a new email distribution method was detected — PDF attachments that download Windows Script Files to install Qbot on victims' devices

19 April

ALPHV ransomware exploits Veritas Backup Exec bugs for initial access

After the initial compromise, the threat actor used the Advanced IP Scanner and ADRecon utilities to gather information about the victim's environment

7 April

The Week in Ransomware

This week was highlighted by a massive BlackBasta ransomware attack targeting DISH Network and taking down numerous subsidiaries, including SlingTV and Boost Mobile

4 March

The Week in Ransomware

From ongoing attacks targeting ESXi servers to sanctions on Conti/TrickBot members, it has been quite a busy week regarding ransomware

11 February