Cuba Ransomware Exploits Veeam Vulnerability
The Cuba ransomware group is exploiting a bug in data backup software exposed in March, warn security researchers. The Russian-speaking gang is deploying a combination of new and old tools, including a high-severity vulnerability in a backup application made by software developer Veeam, said BlackBerry. The Russian-speaking gang is deploying a combination of new and…
White House Pushes Cybersecurity Defense for K-12 Schools
The Biden administration says it want to get ahead of ransomware attacks against schools before tens of millions of pupils resume studies later this month. Typically understaffed and underfunded when it comes to cybersecurity, American K-12 schools have experienced a ramp-up in ransomware attacks, particularly after the novel coronavirus pandemic forced hasty adoption of remote…
In new ransomware model, cloud provider acts as front for bad actors: report
An apparently innocuous cloud hosting provider may be fronting for an Iran-based company that provides command-and-control services to ransomware attackers, according to a report published this week by security consultant and anti-ransomware vendor Halcyon. Cloudzy, the report said, is primarily a virtual private server provider, which accepts cryptocurrency as payment for its services. Halcyon said…
As Ransomware Monetization Hits Record Low, Groups Innovate
The Clop group’s mass exploitation of MOVEit file-transfer software represents the latest stage of innovation in the ever-evolving ransomware ecosystem. As with all cybercrime, criminals’ imperative is simple: maximize illicit profits via the least amount of effort, time and risk. Russian-speaking criminal group Clop’s attacks have affected at least 421 organizations – and likely many…
Progress warns customers of a new critical flaw in MOVEit Transfer software
Progress is informing customers of a new critical SQL injection vulnerability, tracked as CVE-2023-36934, in its MOVEit Transfer software. MOVEit Transfer software recently made the headlines due to the massive Clop ransomware hacking campaign exploiting a vulnerability in the product. The flaw CVE-2023-36934 impacts software versions released before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7…
Ransomware Halts Operations at Japan’s Port of Nagoya
Cargo containers filled with imports and exports from all over the world have been stuck at the Port of Nagoya following a ransomware attack on its networks early Tuesday morning. The port is the largest in Japan and the central shipping hub for international carmaker Toyota. According to its operator, Nagoya Harbor Transportation, it received…
Dutch Critical OT Systems Vulnerable to Hacks
Critical services in the Netherlands could be a potential target of ransomware and hacktivist attackers with ties to Russia as a means to sow large-scale disruptions in the country, according to a Dutch National Cyber Security Centre warning this week. Although the Russian invasion of Ukraine did not immediately result in a high-level of attacks…
Interested in $10,000,000? Ready to turn in the Clop ransomware crew?
The latest high-profile cybercrime exploits attributed to the Clop ransomware crew aren’t your traditional sort of ransomware attacks (if “traditional” is the right word for an extortion mechanism that goes back only to 1989). Conventional ransomware attacks are where your files get scrambled, your business gets totally derailed, and a message appears telling you that…
MOVEit Discloses More Vulnerabilities, Issues Patch
The company behind the MOVEit managed file transfer application is urging customers into a new round of emergency patching after identifying additional vulnerabilities. Progress Software in a Friday update said it had identified additional SQL injection vulnerabilities allowing attackers access to the MOVEit transfer database. “These newly discovered vulnerabilities are distinct from the previously reported…
Iranian Hackers Deploy New Ransomware Against Israeli Firms
Security researchers have discovered an Iran-linked APT group carrying out a new chain of ransomware attacks using a new strain of malware against Israeli organizations. Researchers at Check Point found a ransomware strain called Moneybird that is reminiscent of the Iranian Agrius group’s previous campaigns. Agrius gained notoriety for targeting Israel-based entities with wiper variants,…
