In a troubling development for cybersecurity defenders, three leading ransomware groups — LockBit, Qilin, and DragonForce — have publicly announced a strategic alliance. The partnership is poised to reshape the ransomware ecosystem by enabling these actors to pool resources, share tactics and infrastructure, and amplify the scale and sophistication of future attacks. According to threat intelligence firm ReliaQuest, this coalition may mark a pivotal moment in the evolution of financially motivated cybercrime.

Key Details of the Alliance

• Shared capabilities and infrastructure
  The alliance is designed to allow each group access to the others’ techniques, infrastructure, and resources, strengthening their collective operational capacity.
  ReliaQuest notes that the union emerges amid LockBit’s resurgence; the group had suffered significant setbacks after law enforcement disrupted its network and detained members in 2024.
• LockBit’s comeback and reputation rebuilding
  Following a major takedown in early 2024 under “Operation Cronos,” LockBit had lost both infrastructure and credibility with its affiliates.
  With this new alliance, it aims to regain prominence and restore affiliate trust — potentially catalyzing a resurgence in attacks, particularly targeting critical infrastructure.
• Qilin’s rising prominence
  Qilin has emerged as one of the most active ransomware groups in recent months, having claimed over 200 victims in the third quarter of 2025 alone.
  ZeroFox reports that Qilin has been disproportionately targeting organizations in North America, citing both geopolitical motivations and the expanding attack surface in that region.
• Technological advances and attack breadth
  The timing of the partnership coincides with the launch of LockBit 5.0, which extends the group’s reach to systems running Windows, Linux, and ESXi.
  Experts warn that the combined arsenal of the allied groups could lead to more potent multi-platform attacks and potentially greater complexity in decryptor negotiation.
• Threat expansion and sector targeting
  While U.S., Germany, U.K., Canada, and Italy remain frequent targets, cybercriminals are increasingly striking nontraditional geographies like Egypt, Thailand, and Colombia.
  In Q3 2025 alone, there were at least 1,429 ransomware and digital extortion (R&DE) incidents globally.

Groups such as Qilin, Akira, INC Ransom, Play, and SafePay are now responsible for nearly 47 percent of all attacks across Q2 and Q3 of 2025.

Background: Ransomware Alliances and the Stakes

Ransomware-as-a-Service (RaaS) models have already enabled nontechnical actors to orchestrate attacks by leasing access from developer groups. What’s different in this new alliance is the merging of powerful developer tiers, not just affiliates, signaling a deeper level of coordination.

LockBit, before its takedown, was one of the most prolific groups worldwide, targeting over 2,500 victims and collecting more than USD 500 million in ransom payments in its prime.
The 2024 takedown forced a fragmentation of its operations, but this alliance might very well accelerate its reemergence as a top-tier threat.

Meanwhile, Qilin’s aggressive operations over the past year — especially targeting high-value North American entities — have placed it in the spotlight as a rising contender.
DragonForce’s involvement rounds out a trio that now spans multiple geographies, infrastructures, and attack vectors.

ReliaQuest, in its Q3 2025 ransomware report, warns that if the alliance succeeds in restoring affiliate confidence in LockBit, we could witness a substantial uptick in attacks — especially within sectors considered previously low-risk.
This alliance also emerges amid signs that other threat actors are retooling: for example, “Scattered Spider,” known for social engineering attacks, is reportedly preparing to launch an English-language RaaS program dubbed “ShinySp1d3r.”

Expert Insights & Risks Ahead

Though the primary public information comes via ReliaQuest and ZeroFox reports, cybersecurity analysts widely caution that combining operatives in this way brings serious implications:

• Increased operational sophistication — Pooling intelligence, encryption tooling, and exploit kits may elevate the technical barrier for defenders.
• Greater scale and reach — Expanded infrastructure and affiliate networks could allow attacks to spread faster and across new geographies.
• Target broadening — Higher risk for sectors once deemed “safe zones,” such as small manufacturing, education, or regional government agencies.
• Law enforcement pressure — Coordinated action by global agencies could escalate, but taking down intertwined systems is also more complex operationally.

If the alliance can remain stable and cooperative (which historically has been a challenge for criminal groups), it might persist as a formidable adversary for years.

Conclusion: A Turning Point in Ransomware Warfare

The public formation of this alliance between LockBit, Qilin, and DragonForce marks a potentially significant inflection in ransomware history. It signals not just a tactical partnership, but an ethos shift: threat actors are aligning at higher levels, no longer simply competing or operating in silos. For defenders, the window for complacency narrows — organizations must elevate their threat awareness, continuously harden systems, and invest in intelligence-driven defenses.

As this coalition begins to flex its shared capabilities, the stakes for critical infrastructure, corporations, and government entities alike will rise sharply. The world of ransomware may be entering a new era — one where the line between individual groups becomes blurred and collective power defines dominance.

The post LockBit, Qilin and DragonForce Form Ransomware Alliance appeared first on CyberHood Sentinel.

Scope and Execution of Operation Endgame

Between May 19 and 22, 2025, Operation Endgame mobilized law enforcement agencies from Germany, France, the Netherlands, Denmark, the United Kingdom, the United States, and Canada. The coordinated effort focused on disrupting services and infrastructures that facilitate initial access for ransomware attacks. This phase of the operation targeted malware variants and successor groups that had re-emerged following previous takedowns, including Bumblebee, Lactrodectus, QakBot, HijackLoader, DanaBot, TrickBot, and WARMCOOKIE.

The operation’s achievements are substantial:

• 300 servers dismantled worldwide
• 650 domains neutralized
• €3.5 million in cryptocurrency seized during the action week
• 20 international arrest warrants issued against key individuals involved in providing or operating initial access services to ransomware groups

These actions bring the total amount seized during Operation Endgame to over €21.2 million, underscoring the operation’s ongoing impact since its inception in May 2024.

Targeted Malware and Criminal Networks

Operation Endgame specifically targeted “initial access malware,” which cybercriminals use to infiltrate systems and deploy additional malicious software, including ransomware. The malware variants addressed in this operation are often offered as services to other threat actors, facilitating large-scale ransomware attacks.

Among the individuals targeted, several have been added to the EU Most Wanted list, including:

• Roman Mikhailovich Prokop (aka carterj), 36, associated with the QakBot group
• Danil Raisowitsch Khalitov (aka dancho), 37, associated with the QakBot group
• Iskander Rifkatovich Sharafetdinov (aka alik, gucci), 32, associated with the TrickBot group
• Mikhail Mikhailovich Tsarev (aka mango), 36, associated with the TrickBot group
• Maksim Sergeevich Galochkin (aka bentley, manuel, Max17, volhvb, crypt), 43, associated with the TrickBot group
• Vitalii Nikolaevich Kovalev (aka stern, ben, Grave, Vincent, Bentley, Bergen, Alex Konor), 36, associated with the TrickBot group

These individuals are believed to play significant roles in providing or operating services that grant ransomware groups access to victim systems.

International Collaboration and Future Actions

The success of Operation Endgame highlights the importance of international cooperation in combating cybercrime. Europol and Eurojust provided essential support, including coordination, operational and analytical assistance, cryptocurrency tracing, and facilitating real-time information exchange among participating agencies.

The operation is ongoing, with follow-up actions planned. Several key suspects remain at large, and efforts to apprehend them continue. German authorities have announced that 18 of these suspects will be added to the EU Most Wanted list, emphasizing the commitment to bringing all perpetrators to justice.

Impact on the Cybercrime Landscape

Operation Endgame represents a strategic effort to disrupt the ransomware kill chain at its source by targeting the infrastructure and services that enable these attacks. By dismantling servers, neutralizing domains, and apprehending key individuals, law enforcement agencies aim to significantly hinder the operations of ransomware groups.

Europol Executive Director Catherine De Bolle stated, “This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganize. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source.”

Conclusion

The dismantling of over 300 servers and the seizure of €3.5 million in cryptocurrency during Operation Endgame marks a significant milestone in the global effort to combat ransomware and cybercrime. The operation’s success underscores the effectiveness of international collaboration and the importance of targeting the foundational elements of cybercriminal operations.

As Operation Endgame continues, law enforcement agencies remain vigilant, adapting their strategies to counter the evolving tactics of cybercriminals. The ongoing efforts serve as a reminder that, through coordinated action and determination, the global community can make substantial strides in securing the digital landscape against malicious actors.

The post Europol’s Operation Endgame Dismantles Global Ransomware Infrastructure appeared first on CyberHood Sentinel.

What is Ragnar Loader?

Ragnar Loader is an advanced modular malware loader designed to deploy additional malicious payloads while evading detection mechanisms. Initially discovered in August 2021 by Bitdefender, the malware was linked to an attempted cyberattack on a U.S. financial institution by FIN8. Since then, it has undergone continuous development, with new features enhancing its stealth capabilities and versatility.

According to Swiss cybersecurity firm PRODAFT, Ragnar Loader serves as a key component in maintaining access within breached networks, operating as a bridge for deploying ransomware and other malicious activities. Its deployment techniques involve PowerShell-based payload execution, strong encryption (RC4 and Base64), and process injection, making it highly resilient against conventional security defenses.

Which Cybercriminal Groups Use Ragnar Loader?

Several notorious cybercrime groups leverage Ragnar Loader for their operations:

• FIN7: A financially motivated group known for targeting hospitality, retail, and financial sectors. They often use Ragnar Loader to drop additional payloads, including point-of-sale (POS) malware and ransomware.
• FIN8: This group has been linked to various attacks on financial institutions and enterprises, using Ragnar Loader as a precursor to ransomware deployment.
• Ruthless Mantis (formerly REvil): A high-profile ransomware gang known for launching supply chain attacks and extortion campaigns.
• Ragnar Locker: Though separate from Ragnar Loader, this ransomware group has used the malware to enhance its stealth and initial network penetration techniques.

How Ragnar Loader Works

The malware toolkit functions in several stages:

1. Initial Compromise

Attackers distribute Ragnar Loader via phishing emails, malicious attachments, and software exploits. The malware is typically delivered as an archive containing different modules.

2. Persistence and Stealth

Once executed, Ragnar Loader establishes a backdoor using PowerShell scripts and obfuscation techniques to evade detection. It deploys anti-analysis mechanisms that make reverse engineering difficult.

3. Command-and-Control (C2) Communication

The malware connects to a remote command-and-control (C2) server, allowing cybercriminals to execute commands, exfiltrate data, and deploy additional malicious payloads.

4. Payload Deployment

Ragnar Loader serves as a staging tool for deploying ransomware, spyware, or other advanced cyber threats. Attackers use it to laterally move within a network, gaining deeper access to sensitive information.

Why is Ragnar Loader Dangerous?

1. Highly Modular and Upgradable

The malware is designed to be continuously updated, meaning cybercriminals can introduce new functionalities to bypass evolving security measures.

2. Stealth Capabilities

With strong encryption and obfuscation, Ragnar Loader remains undetected for extended periods, making it difficult for security teams to track and remove.

3. Used by Multiple Threat Actors

Unlike malware created by a single hacking group, Ragnar Loader is widely used across different cybercrime syndicates, increasing its threat level.

Mitigation and Defense Strategies

To protect against Ragnar Loader and similar threats, organizations should adopt the following cybersecurity best practices:

• Implement Endpoint Detection & Response (EDR): Advanced threat detection tools can identify unusual behavior related to Ragnar Loader.
• Regularly Update Software & Patch Vulnerabilities: Cybercriminals exploit outdated software. Ensure all systems are patched against known security flaws.
• Educate Employees on Phishing Threats: Since phishing emails are a common delivery method, cybersecurity awareness training is crucial.
• Monitor Network Traffic for Anomalies: Security teams should track unusual outbound connections to detect C2 server communication.
• Use Strong Access Controls: Implement multi-factor authentication (MFA) and limit privileged access to reduce the impact of credential theft.

Conclusion

The discovery of Ragnar Loader highlights the increasing sophistication of modern cyber threats. Its use by groups like FIN7, FIN8, and Ruthless Mantis underscores the urgent need for organizations to enhance their security posture. As cybercriminals continue to refine their tactics, businesses must stay proactive by implementing advanced threat detection mechanisms and employee awareness programs to minimize risks.

For the latest updates on cybersecurity threats, follow HoodGuy.net.

The post Ragnar Loader: A New Cyber Weapon Used by FIN7, FIN8, and Ruthless Mantis appeared first on CyberHood Sentinel.

APT41, known for its dual focus on espionage and financially motivated cybercrime, has a history of targeting various industries across the globe. Their attacks typically involve exploiting vulnerabilities in widely-used software to establish a foothold, which is then used for further network exploration. The group’s ability to blend criminal and state-sponsored activities poses a significant challenge for cybersecurity professionals.

In this latest incident, the attackers’ tactics evolved in response to the organization’s security measures. When detection mechanisms were introduced, APT41 swiftly altered its methods to maintain its covert presence. The attackers displayed a high level of operational security, minimizing the use of well-known malware signatures and employing custom tools to avoid triggering alarms. This persistence and adaptability highlight the group’s strategic approach, leveraging their advanced skill set to achieve their objectives.

The incident began with initial exploitation using spear-phishing emails containing malicious links. Once a foothold was established, the attackers used sophisticated techniques, such as “living off the land” tactics, where they employed existing system tools to avoid detection. Additionally, they leveraged custom scripts and tailored malware to extract sensitive data, focusing on credentials and network configurations that could be used for further attacks.

Throughout the operation, the attackers employed multiple techniques to maintain persistence within the network, including modifying registry keys, installing backdoors, and using legitimate administrative tools like PowerShell. These methods allowed them to remain undetected for an extended period, evading standard detection mechanisms and making incident response challenging.

APT41’s focus on the gambling sector is not new; the group has targeted similar industries in the past for both financial and strategic gains. Their approach in this attack indicates a deep understanding of the targeted sector’s infrastructure and security practices, allowing them to adjust their strategies in real-time. This adaptability is a hallmark of advanced persistent threats (APTs), which often involve long-term, targeted campaigns aimed at high-value assets.

The security implications of this incident extend beyond the gambling industry, as it underscores the evolving nature of nation-state threats and the increasing use of cyber tactics for economic gain. Organizations across all sectors must recognize the potential for state-sponsored groups to target them, not just for espionage but for financial exploitation as well. This broadens the scope of potential targets and necessitates a more proactive and comprehensive approach to cybersecurity.

For organizations aiming to defend against such advanced threats, a multi-layered defense strategy is essential. This includes implementing robust endpoint detection and response (EDR) solutions, regularly updating and patching software, and conducting continuous monitoring for signs of unusual activity. Security awareness training for employees, particularly regarding phishing tactics, can also help reduce the risk of initial compromise.

The attack on the gambling industry by APT41 serves as a reminder of the complexities involved in defending against state-sponsored actors. Their ability to adapt, innovate, and remain undetected for extended periods makes them particularly dangerous. Cybersecurity teams must stay vigilant, employing advanced threat detection technologies and methodologies to identify potential intrusions early and respond effectively to mitigate damage.

APT41’s activities underscore the blurred lines between cyber espionage and financially motivated crime. While the group’s actions are aligned with national interests, their profit-driven approach suggests a dual agenda. This hybrid model of cybercrime, where state actors pursue financial objectives alongside traditional intelligence-gathering, represents a growing trend in the world of cyber threats.

The incident also emphasizes the importance of sharing threat intelligence across industries and with government agencies. Collaboration can help organizations better understand emerging threats and improve their defenses against sophisticated adversaries like APT41. Threat intelligence sharing can reveal patterns, expose new tactics, techniques, and procedures (TTPs) used by attackers, and enhance the overall security posture of potential targets.

As cyber threats continue to evolve, the need for robust security measures becomes increasingly critical. Organizations should not only focus on prevention but also invest in detection and response capabilities that can identify breaches early in their lifecycle. This proactive approach is essential for minimizing the impact of sophisticated, persistent adversaries.

APT41’s latest campaign against the gambling sector serves as a case study in the challenges of modern cybersecurity. It illustrates the lengths to which state-sponsored groups will go to achieve their objectives and the importance of remaining vigilant in the face of evolving threats. The combination of financial motivation and state-sponsored support creates a formidable adversary capable of executing complex, long-term operations with significant consequences for their targets.

The post Chinese APT41 Hackers Target Gambling Industry in Sophisticated Cyberattack appeared first on CyberHood Sentinel.

In a shocking revelation, the LockBit ransomware gang has claimed to have breached the US Federal Reserve, stealing an astounding 33 terabytes of sensitive data. This cyber-attack, if confirmed, represents a significant threat to national security and financial stability. This article delves into the details of the breach, the history of the LockBit group, the potential implications, and the responses from various stakeholders.

The Breach: What Happened?

The LockBit ransomware group announced on their dark web blog that they had successfully infiltrated the US Federal Reserve’s systems. The group claims to have obtained a massive trove of sensitive information, which they have termed “juicy banking information.” The exact nature of the data remains undisclosed, but LockBit has hinted at possessing critical American banking secrets. The ransom deadline has been set for June 25, 2024, threatening to release the data publicly if their demands are not met.

Who is LockBit?

LockBit is a highly sophisticated ransomware group known for its aggressive tactics and high-profile targets. Established in 2019, the group has quickly risen to prominence in the cybercrime world. They utilize a ransomware-as-a-service (RaaS) model, enabling affiliates to use their ransomware tools in exchange for a share of the profits. Some notable victims of LockBit’s previous attacks include:

• Boeing: The aerospace giant faced significant disruptions when LockBit encrypted their systems.
• ICBC Bank: One of China’s largest banks, which had its operations hampered by a LockBit attack.
• Bangkok Airways: The airline suffered data breaches affecting thousands of passengers.

Despite numerous law enforcement efforts to curb their activities, including identifying and exposing their alleged leader, Dmitry Yuryevich Khoroshev, LockBit continues to operate with impunity.

Understanding Ransomware Attacks

Ransomware attacks involve malicious software designed to encrypt a victim’s data, rendering it inaccessible until a ransom is paid. These attacks can cripple organizations, leading to significant financial losses and operational disruptions. LockBit’s ransomware is particularly notorious for its speed and encryption strength, making it a formidable threat.

The Implications of the Federal Reserve Breach

The potential ramifications of this breach are vast and troubling. If the stolen data includes sensitive financial information, it could lead to:

• Financial Instability: The exposure of critical banking data could undermine confidence in the US financial system, potentially causing market disruptions.
• National Security Threats: The Federal Reserve plays a crucial role in national economic security. A breach of this magnitude could have far-reaching implications for national security.
• Legal and Regulatory Consequences: The breach may lead to stringent new regulations and legal actions aimed at improving cybersecurity defenses across the financial sector.

Government and Institutional Responses

In the wake of the breach, the US government and cybersecurity agencies are expected to take swift action. This includes:

• Investigation and Attribution: Identifying the perpetrators and understanding the breach’s scope will be a top priority.
• Strengthening Defenses: Enhancing cybersecurity measures within federal institutions to prevent future breaches.
• Public Communication: Informing the public and affected parties about the breach and potential risks.

Mitigation Strategies for Organizations

Given the increasing frequency and sophistication of ransomware attacks, organizations must adopt comprehensive cybersecurity strategies to protect themselves. Key measures include:

• Regular Backups: Ensuring data is regularly backed up and stored securely.
• Employee Training: Educating employees about phishing attacks and other common ransomware delivery methods.
• Advanced Security Solutions: Implementing advanced cybersecurity tools, such as intrusion detection systems and endpoint protection.

The Future of Cybersecurity

This incident underscores the evolving nature of cyber threats and the need for continuous adaptation in cybersecurity practices. Future strategies may involve:

• Increased Collaboration: Enhanced cooperation between government agencies, private sector organizations, and international partners to combat cybercrime.
• Innovative Technologies: Leveraging artificial intelligence and machine learning to detect and respond to threats in real-time.
• Regulatory Frameworks: Developing robust regulatory frameworks that mandate stringent cybersecurity practices across industries.

Conclusion

The alleged breach of the US Federal Reserve by LockBit is a stark reminder of the persistent and evolving threat posed by ransomware groups. As institutions and governments worldwide grapple with these challenges, the importance of robust cybersecurity measures cannot be overstated. Continuous vigilance, proactive defense strategies, and global cooperation will be key to mitigating the risks and safeguarding our digital future.

The post LockBit Ransomware Strikes US Federal Reserve: 33 TB data leaked appeared first on CyberHood Sentinel.

The U.S. Federal Bureau of Investigation (FBI) recently disclosed the distribution of over 7,000 decryption keys related to the LockBit ransomware, aiming to assist victims in recovering their data without cost. This significant move underscores the agency’s commitment to combating ransomware and supporting affected organizations.

Background on LockBit Ransomware

LockBit, a notorious ransomware group, has been responsible for over 2,400 attacks worldwide, including 1,800 in the United States. The group’s operations were disrupted in February 2024 by an international law enforcement operation named “Cronos,” spearheaded by the U.K. National Crime Agency (NCA).

Key Developments and Arrests

In May 2024, Dmitry Yuryevich Khoroshev, a 31-year-old Russian national, was identified as LockBit’s administrator and developer. Despite Khoroshev’s arrest, LockBit continues to operate, albeit at reduced capacity, leveraging new infrastructure to evade law enforcement efforts.

FBI’s Role and Statements

Assistant Director Bryan Vorndran of the FBI Cyber Division announced the initiative at the 2024 Boston Conference on Cyber Security (BCCS). He emphasized the FBI’s efforts to reach out to known LockBit victims and encouraged potential victims to contact the Internet Crime Complaint Center (IC3) for assistance.

Current Threat Landscape

LockBit remains active, though less prolific than before. Statistics from Malwarebytes revealed that LockBit was responsible for 28 attacks in April 2024, ranking it behind other ransomware groups such as Play, Hunters International, and Black Basta.

Challenges in Ransomware Recovery

Vorndran highlighted the uncertainty surrounding data recovery from ransomware attacks. Paying ransoms does not guarantee data retrieval or its permanent deletion. The Veeam Ransomware Trends Report 2024 indicates that organizations typically recover only 57% of compromised data, exposing them to significant data loss and ongoing risks.

Emerging Ransomware Threats

New ransomware variants, including SenSayQ and CashRansomware, have surfaced, targeting vulnerable systems. The TargetCompany ransomware, also known as Mallox and Water Gatpanapun, has introduced a Linux variant that exploits Microsoft SQL server vulnerabilities to infiltrate VMWare ESXi systems.

Technical Insights

Trend Micro researchers reported that the new Linux variant employs a shell script for payload delivery and exfiltrates victim data to multiple servers, ensuring the attackers retain a backup. The attacks are attributed to an affiliate known as Vampire.

Conclusion

The FBI’s distribution of decryption keys marks a crucial step in supporting ransomware victims and disrupting cybercriminal activities. However, the evolving ransomware landscape necessitates continuous vigilance and robust cybersecurity measures.

The post FBI Distributes 7,000 LockBit Ransomware Decryption Keys to Aid Victims appeared first on CyberHood Sentinel.

Rackspace’s hosted Microsoft Exchange service started experiencing problems on Friday, December 2. The company shut down the impacted environment and confirmed on Saturday that it was a security incident.

“We have since determined this suspicious activity was the result of a ransomware incident.” company mentioned in the press brief.

“If we determine sensitive information was affected, we will notify customers as appropriate,” Rackspace said.

“Based on the investigation to date, we believe that this incident was isolated to our Hosted Exchange business. The Company’s other products and services are fully operational, and we have not experienced any impact to our Rackspace Email product line and platform,” it added.

The company also provides a temporary solution for customers during the migration to Microsoft 365: a forwarding option that will automatically route all mail sent to a Hosted Exchange user to an external email address.

“At this time, we are unable to provide a timeline for restoration of the Hosted Exchange environment. We are working to provide customers with archives of inboxes where available, to eventually import over to Microsoft 365,” Rackspace added in today’s update.

The post Rackspace confirms it is targeted by a Ransomware attack appeared first on CyberHood Sentinel.

Medibank is one of the largest private health insurance company which covers around 4 million users.

The ransomware gang threatened that it would leak data allegedly stolen from Medibank’s systems within 24 hours. The gang is yet to reveal how much data it exfiltrated out of Medibank’s network and hasn’t shared any proof to verify that the data has been leaked.

Medibank refuses to pay the ransom

Medibank did not specify that which Ransomware gang has targeted the company , the company said in a press release published that it refused a ransom demand made by the attackers.

“Today, we’ve announced that no ransom payment will be made to the criminal responsible for this data theft,” Medibank said.

“Based on the extensive advice we have received from cybercrime experts we believe there is only a limited chance paying a ransom would ensure the return of our customers’ data and prevent it from being published.”

The health insurer added that paying the attackers would also likely motivate them to go after customers affected by the data breach.

Furthermore, a ransom payment will encourage others to attack Australian organizations, putting more people at risk.

“There is a strong chance that paying puts more people in harm’s way by making Australia a bigger target,” the company added. “This decision is consistent with the position of the Australian Government.”

Millions of users might be impacted due to this data leak

The ransomware gang starts leaking the allegedly stolen data to back their claims and attempt to force Medibank’s hand into negotiating a deal, the company revealed the attackers gained access to sensitive information belonging to millions of customers. Initially Medibank denied claims of data leak and access by the attackers.

The complete rundown of data Medibank believes was exposed in the breach includes the following:

• Name, date of birth, address, phone number, and email address for approximately 9.7 million current and former customers and authorized representatives
• Medicare numbers (but not expiry dates) for ahm health insurance (ahm) customers
• Passport numbers (but not expiry dates) and visa details for international student customers 
• Health claims data for roughly 480,000 Medibank, ahm, and international customers
• Health provider details, including names, provider numbers, and addresses

Medibank added that it also believes the cybercriminals behind the October attack have not gained access to financial information (credit card and banking details), primary identity documents (e.g., driver’s licenses), or health claims data for extras services (like dental, physio, optical and psychology).

“Given the nature of this crime, unfortunately we now believe that all of the customer data accessed could have been taken by the criminal,” Medibank

The post Medibank data on sale by the Ransomware Gangs appeared first on CyberHood Sentinel.

It can take less than two days for the FIN12 gang to execute on the target network a file-encrypting payload – most of the time Ryuk ransomware.

Fast-moving FIN12

FIN12 is a prolific threat actor with a strong focus on making money that executes ransomware attacks since at least October 2018.

The group is a close partner of the TrickBot gang and targets high-revenue victims (above $300 million) from various activity sectors and regions on the globe.

FIN12 is characterized by skipping the data exfiltration step that most ransomware gangs have adopted to increase their chances of getting paid.

This attribute allows the group to execute attacks at a much faster rate than other ransomware operations, taking them less than two days from the initial compromise to the file encryption stage.

According to data collected from investigations, most ransomware gangs that also steal data have a median dwell time of five days and the average value is 12.4 days.

With FIN12, the average time spent on the victim network dropped each year, getting to less than three days in the first half of 2021.

During the attack, FIN12 also exfiltrated about 90GB of data to multiple cloud storage providers and extorted the victim twice to keep the data off the public space.

Conti ransomware appeared in isolated incidents at the end of 2019 and shares code with Ryuk. Conti activity picked up in July 2020 as Ryuk ransomware attacks started to become less frequent.

The researchers say that FIN12 also engaged in other ransomware incidents that involved data theft using Ryuk. In those cases, the information was exfiltrated to the attacker’s machines and was not leveraged for extortion.

Mandiant says that nearly 20% of their incident response engagements since September 2020 are for FIN12 intrusions.

TrickBot’s initial access

The researchers note that FIN12 did not breach the networks themselves but obtained initial access from their partners, via TrickBot and BazarLoader in particular; other initial access vectors were observed.

Mandiant says that despite FIN12’s use of ”overlapping toolsets and services including backdoors, droppers, and codesigning certificates,” they track the group as a distinct threat actor because they showed they can work independently of the two malware families.

The set of initial access vectors that the researchers observed includes phishing emails and compromised remote logins to Citrix environment.

The post Healthcare is targeted by the FIN12 Ransomware appeared first on CyberHood Sentinel.

After successfully conducting the attack on US Colonial Pipeline DarkSide gang was facing increased scrutiny from international law enforcement and US.

During may the Darkside ransomware has abruptly shutdown its operation after losing access to their servers and cryptocurrency which was seized by an unknown third-party. 

In July a new ransomware operation known as BlackMatter emerged which is actively attacking victims and purchasing network access from other attackers to launch attacks.

Security researchers analyzing the Blakmatter decryptor and concluded that the encryption mechanism used by the BlackMatter is similar to the one used by the DarkSide ransomware gang.

Fabian Wosar told Bleeping computer that the encryption routines used by BlackMatter are pretty much the same, including a custom Salsa20 matrix unique to DarkSide.

When encrypting data using the Salsa20 encryption algorithm, a developer provides an initial matrix consisting of sixteen 32-bit words.

When encrypting files instead of using constant strings, a position, nonce, and key, for each encrypted file, DarkSide fills the words with random data.

This matrix is then encrypted with a public RSA key and stored in the footer of the encrypted file.

Fabian says this Salsa20 implementation was previously only used by DarkSide, and now BlackMatter.

DarkSide used an RSA-1024 implementation unique to their encryptor, which BlackMatter also uses.

While there is not 100% proof that BlackMatter is a rebrand of the DarkSide operation, many similar characteristics make it hard to believe this is not the case.

When we take the same encryption algorithms, the similar language used on the BlackMatter sites, similar craving of media attention, and similar color themes for their TOR sites, it is highly like that BlackMatter is the new DarkSide.

A rebrand from DarkSide also explains the reason the new BlackMatter group won’t target the “Oil and Gas industry (pipelines, oil refineries),” which led to their previous downfall.

Unfortunately, this is a highly skilled group that targets multiple device architectures, including Windows, Linux, and ESXi servers.

Due to this, we will need to keep an eye on this new group as they will surely perform attacks on well-known targets in the future.

The post Darkside Ransomware gang rebranded as BlackMatter Ransomware appeared first on CyberHood Sentinel.