The Week in Ransomware - May 19th 2023 - A Shifting Landscape

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-may-19th-2023-a-shifting-landscape/

In the ever-shifting ransomware landscape, we saw new ransomware gangs emerge, threat actors return from a long absence, operations shifting extortion tactics, and a flurry of attacks on the enterprise.

Over the past few weeks, we have reported on new ransomware operations that have emerged in enterprise attacks, including the new Cactus, Akira, RA Group operations.

This week a relatively new operation named Abyss hit L3Harris, a $17 billion defense company, shifting them into the spotlight.

We also learned about MalasLocker, a ransomware operation targeting Zimbra servers since March. The hackers also have an unusual extortion tactic, demanding victims donate to an approved charity to receive a decryptor and prevent a data leak.

Whether or not the ransomware gang will keep to the arrangement or if this is just an interesting marketing campaign is too soon to tell.

As for shifting extortion tactics, a joint FBI and CISA report confirmed that the BianLian ransomware operation has switched to extortion-only attacks after Avast released a decryptor.

We also learned about new attacks and significant developments in previous ones:

• Capita has started to tell its customers to assume that their data has been stolen.
• PharMerica disclosed that a Money Message ransomware attack exposed the data for 5.8 million patients.
• LACROIX announced getting hit by a ransomware attack on May 12th.
• ScanSource finally confirmed that its multi-day outage was due to a ransomware attack.
• LockBit ransomware claimed an attack on the pharmaceutical network Farmalink.
• Looks like Dish Networks paid a ransom, as they say they confirmed the attackers deleted all stolen data.

Finally, researchers and law enforcement released new reports:

• Microsoft warned that the notorious FIN7 threat actors have returned, now using the CLOP ransomware in attacks.
• A new report about researchers going undercover in the Qilin ransomware operation.
• A technical analysis of the new CryptNet ransomware.

The Week in Ransomware - May 19th 2023 - A Shifting Landscape

In the ever-shifting ransomware landscape, we saw new ransomware gangs emerge, threat actors return from a long absence, operations shifting extortion tactics, and a flurry of attacks on the enterprise.

www.bleepingcomputer.com