Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ransomware. Show all posts
Ransomware
Cyber Attacks Japan KWE Ransomware

Japanese Logistics Firm KWE Faces Ransomware Attack, Causing Service Delays

 



Kintetsu World Express (KWE), a large logistics and freight company based in Japan, recently experienced a ransomware attack that caused trouble with some of its systems. As a result, certain customers are facing interruptions in service.

The company has not shared many details yet. The name of the group responsible for the attack remains unknown. However, KWE said that work is ongoing to bring systems back to normal and to find out if any data was accessed without permission.

This incident has raised concerns because it follows a similar case that happened about a year ago. In that earlier situation, a hacker group called “888” claimed to have stolen data from many of KWE’s clients. It is not clear if the two events are connected.


A Growing Pattern of Cyberattacks in Japan

KWE is not the only major business in Japan facing cyberattacks. Over the past year, several well-known Japanese companies have also been targeted. According to reports from cybersecurity experts, at least 46 organizations in Japan were hit by such attacks since late 2024.

Some of the most well-known victims include NTT Docomo, which is a leading mobile network operator, and Kadokawa, a large media company. Other businesses hit include Casio, which is known for its watches, and major banks such as Mizuho Bank, Resona Bank, and Mitsubishi UFJ Bank.

These attacks are part of a larger problem where cybercriminals try to gain control over systems or steal private data. In many ransomware cases, hackers lock important files and ask the company to pay money to get access back. These attacks can cause serious damage, disrupt operations, and lead to loss of trust.


What’s Next for KWE

KWE is continuing to fix the affected systems and investigate what happened. The company said it will keep its customers informed as it works on solutions.

Cybersecurity professionals are warning all companies, not just in Japan but around the world, to take steps to improve their digital security. Setting up strong defenses and preparing for emergencies can help reduce the damage caused by such attacks.

For now, it’s unclear how long the recovery will take, but this event shows how no company is completely safe from online threats.

Read more »
ZeroTrust
2FA AIsecurity credentialstuffing CyberCrime Darkweb Data Breach GenZ Infostealer passwordmanager Passwords phishing Ransomware ZeroTrust

Infostealer Malware Soars 500% as 1.7 Billion Passwords Leak on Dark Web

 

A new report has exposed a staggering 500% rise in infostealer malware attacks, with over 1.7 billion passwords leaked on the dark web in 2024 alone. Despite the growing threat, poor password hygiene continues to be a critical issue, especially among Gen Z users. Cybersecurity experts are now calling for a complete rethink of digital safety practices, urging organizations and individuals to adopt zero-trust frameworks, AI-driven defenses, and reform in user behavior.

Infostealer malware is gaining traction as a preferred tool among cybercriminals. These lightweight, silent programs are often embedded in pirated software or spread via phishing attacks. Once inside a system, they exfiltrate sensitive data including stored credentials, autofill data, cookies, and even crypto wallet details without raising alarms. This stolen information is then compiled into massive combo lists—datasets of usernames and passwords—that are sold or traded on dark web forums. These lists power credential-stuffing attacks that enable hackers to take control of accounts on a mass scale.

Underground marketplaces have reportedly listed over 100 billion compromised credentials, marking a 42% increase from the previous year. Cybercrime syndicates such as BestCombo, BloddyMery, and ValidMail have become notorious for brokering access to stolen identities, fueling everything from account takeovers to financial fraud, ransomware deployment, and corporate espionage.

Yet, despite repeated warnings, user behavior remains worryingly casual. The 2025 World Password Day Survey revealed that 72% of Gen Z users admit to reusing passwords across multiple services. Even more strikingly, 79% acknowledge the risks of reuse, while 59% continue to use the same credentials even after a breach. Shockingly, only 10% reported updating their passwords consistently after being informed of a compromise. Additionally, 38% of Gen Z respondents said they only alter one character when prompted to update a password, and 30% frequently forget their credentials—despite the availability of password recovery features and password managers.

Although 46% of Gen Z users claim to use password managers, their actual habits—like sharing credentials via body text, screenshots, or in conversation—undermine any security those tools provide. This gap between intention and action continues to weaken overall cyber defense.

On the enterprise front, the situation is no better. According to a cybersecurity expert, 27% of businesses still do not enforce basic password policies. Even among organizations that do, users often respond to frequent password change requirements with insecure workarounds, such as reusing slightly modified passwords.

A data privacy solicitor commented, “If your system allows users to bypass complexity rules or reuse old passwords, your policy is meaningless,” she warned.

Experts also note that even strong password practices can't address all threats. Vulnerabilities like device-level breaches, session hijacking, and social engineering tactics necessitate broader security strategies. Resta advises that organizations should go beyond password policies and invest in multi-layered defenses:
“Organizations must maintain robust incident response plans alongside 2FA, AI-driven anomaly detection, and Zero Trust Architecture (ZTA).”
Read more »
UK Government
Cyber Security Public Sector Ransomware UK Government

Understanding the UK’s New Rule on Ransomware Payments in the Public Sector


The UK government has introduced a new policy that stops public sector organizations from making payments to cybercriminals during ransomware attacks. This decision was made to reduce the number of attacks by taking away the money motivation behind them.

The government believes that if attackers know they won’t get paid, they may stop targeting essential services like public hospitals, schools, or councils. However, this move has sparked a lot of discussion among cybersecurity experts and business leaders.


Why This Rule Could Be Difficult to Enforce

While the aim is to protect public services, some people believe organizations might still find ways to make payments secretly. For instance, if a company operates both in the UK and another country, it might use its foreign office to make the payment. Others might try to hide the payment by calling it a regular business expense.

These loopholes could weaken the purpose of the ban. It might even create an unfair situation where some organizations quietly pay and recover faster, while others follow the rules and face longer disruptions.


The Pressure on Business Leaders

Leaders responsible for cybersecurity face a difficult situation. While no one wants to support criminal activity, refusing to pay can lead to bigger problems. For example, a ransomware attack could shut down critical services or expose personal information.

In some extreme cases, businesses might feel that paying the ransom is the only way to continue operations or protect sensitive data. This rule could put extra pressure on leaders who are already struggling to make the right decision during a crisis.


Less Reporting, More Risks

Another concern is that if payments are banned, organizations might stop reporting ransomware incidents altogether. They may choose to hide the true nature of the attack to avoid breaking the law or getting into trouble.

This lack of transparency can be dangerous. If fewer cases are reported, cybersecurity experts won’t have enough data to understand new threats or how attacks are evolving. That means it will be harder to prepare for future attacks, leaving more organizations at risk.


Is There a Better Way Forward?

Many experts believe that instead of a complete ban, the government could allow exceptions in very serious situations. Organizations could be required to report the attack immediately and get approval from authorities before making any payments.

This would give the government better visibility into ransomware activity while still giving organizations the flexibility to act when needed. At the same time, public sector workers should receive better training so they know how to handle cyber threats early and prevent serious damage.

In short, while the new rule is a step toward fighting cybercrime, it’s important to create a balanced plan that supports both security and practicality. 

Read more »
Ransomware
Akira Attack Breach Cloud Cybersecurity Data Encryption Extortion FBI Hitachi malware Ransomware

Hitachi Vantara Takes Servers Offline Following Akira Ransomware Attack

 

Hitachi Vantara, a subsidiary of Japan's Hitachi conglomerate, temporarily shut down several servers over the weekend after falling victim to a ransomware incident attributed to the Akira group.

The company, known for offering data infrastructure, cloud operations, and cyber resilience solutions, serves government agencies and major global enterprises like BMW, Telefónica, T-Mobile, and China Telecom.

In a statement to BleepingComputer, Hitachi Vantara confirmed the cyberattack and revealed it had brought in external cybersecurity specialists to assess the situation. The company is now working to restore all affected systems.

“On April 26, 2025, Hitachi Vantara experienced a ransomware incident that has resulted in a disruption to some of our systems," Hitachi Vantara told BleepingComputer.

"Upon detecting suspicious activity, we immediately launched our incident response protocols and engaged third-party subject matter experts to support our investigation and remediation process. Additionally, we proactively took our servers offline in order to contain the incident.

We are working as quickly as possible with our third-party subject matter experts to remediate this incident, continue to support our customers, and bring our systems back online in a secure manner. We thank our customers and partners for their patience and flexibility during this time."

Although the company has not officially attributed the breach to any specific threat actor, BleepingComputer reports that sources have linked the attack to the Akira ransomware operation. Insiders allege that the attackers exfiltrated sensitive data and left ransom notes on infiltrated systems.

While cloud services remained unaffected, sources noted that internal platforms at Hitachi Vantara and its manufacturing arm experienced disruption. Despite these outages, clients operating self-hosted systems are still able to access their data.

A separate source confirmed that several government-led initiatives have also been impacted by the cyberattack.

Akira ransomware first appeared in March 2023 and swiftly became notorious for targeting a wide range of sectors worldwide. Since its emergence, the group has reportedly compromised more than 300 organizations, including high-profile names like Stanford University and Nissan (in Oceania and Australia).

The FBI estimates that Akira collected over $42 million in ransom payments by April 2024 after infiltrating over 250 organizations. According to chat logs reviewed by BleepingComputer, the gang typically demands between $200,000 and several million dollars, depending on the scale and sensitivity of the targeted entity.

Keywords: ransomware, cybersecurity, Hitachi, Akira, cloud, breach, data, FBI, malware, attack, encryption, extortion, hacking, disruption, recovery, infrastructure, digital, protection
Read more »
Ransomware
Cyberattack Data Breach DaVita Healthcare Interlock Ransomware

Interlock Ransomware Gang Claims DaVita Cyberattack, Leaks Alleged Data Online

 

jThe Interlock ransomware group has taken credit for a recent cyberattack on DaVita, a leading U.S. kidney care provider. The group claims to have exfiltrated a significant amount of data, which it has now leaked on the dark web.

DaVita, a Fortune 500 company, operates over 2,600 dialysis centers across the U.S., employs around 76,000 people in 12 countries, and generates more than $12.8 billion in annual revenue. On April 12, the healthcare giant informed the U.S. Securities and Exchange Commission (SEC) that it had been hit by a ransomware incident that disrupted some operations. At the time, the company said it was assessing the impact.

Earlier today, the Interlock group publicly listed DaVita as a victim on its data leak site (DLS) hosted on the dark web. The cybercriminals claim to have stolen approximately 1.5 terabytes of data, including around 700,000 files containing sensitive information—ranging from patient records and user account data to insurance documents and financial details.

The leaked files were released following what appears to be a failed negotiation between Interlock and DaVita. The authenticity of the exposed files has not been independently verified by BleepingComputer.

In response to the data leak, a DaVita spokesperson told BleepingComputer: "We are aware of the post on the dark web and are in the process of conducting a thorough review of the data involved."

"A full investigation regarding this incident is still underway. We are working as quickly as possible and will notify any affected parties and individuals, as appropriate."

"We are disappointed in these actions against the healthcare community and will continue to share helpful information with our vendors and partners to raise awareness on how to defend against these attacks in the future."

Patients who have received care at DaVita facilities are advised to remain alert for phishing attempts and report any suspicious activity to authorities.

Interlock emerged in the ransomware scene in September last year, primarily targeting Windows and FreeBSD systems. Unlike many groups, Interlock does not collaborate with affiliates but has demonstrated increasing activity and sophistication.

A recent report by cybersecurity firm Sekoia highlighted a shift in Interlock’s approach. The group is now using “ClickFix” techniques to deceive victims into deploying info-stealers and remote access trojans (RATs)—a method that paves the way for ransomware deployment.
Read more »
trending news
DragonForce Ransomware Group malware News Ransomware trending news

DragonForce Unveils Cartel-Style Ransomware Model to Attract Affiliates

The ransomware landscape is seeing a shift as DragonForce, a known threat actor, introduces a new business model designed to bring various ransomware groups under a single, cartel-like umbrella. This initiative is aimed at simplifying operations for affiliates while expanding DragonForce’s reach in the cybercrime ecosystem. 

Traditionally, ransomware-as-a-service (RaaS) operations involve developers supplying the malicious tools and infrastructure, while affiliates carry out attacks and manage ransom negotiations. In exchange, developers typically receive up to 30% of the ransom collected. DragonForce’s updated model deviates from this approach by functioning more like a platform-as-a-service, offering its tools and infrastructure for a smaller cut—just 20%. 

Under this new setup, affiliates are allowed to create and operate under their own ransomware brand, all while utilizing DragonForce’s backend systems. These include data storage for exfiltrated files, tools for ransom negotiations, and malware deployment systems. This white-label model allows groups to appear as independent operations while relying on DragonForce’s infrastructure. 

A spokesperson for DragonForce told BleepingComputer that the group operates with clear rules and standards, which all affiliates are expected to follow. Any violations, they say, result in immediate removal from the network. Though these rules aren’t publicly disclosed, the group claims to maintain control since all services run on its servers. 

Interestingly, DragonForce claims it avoids certain targets in the healthcare sector, specifically facilities treating cancer and heart conditions. The group insists its motives are purely financial and not intended to harm vulnerable individuals. Cybersecurity analysts at Secureworks have noted that this new structure could appeal to both inexperienced and seasoned attackers. 

The simplified access to powerful ransomware tools, without the burden of managing infrastructure, lowers the barrier to entry and could lead to a broader adoption among cybercriminals. DragonForce has indicated its platform is open to unlimited affiliate brands capable of targeting a range of systems, including ESXi, NAS, BSD, and Windows environments. 

While the number of affiliates joining the network remains undisclosed, the group claims to have received interest from several prominent ransomware outfits. One such group, RansomBay, is already reported to be participating in the model. As this cartel-style operation gains traction, it could signal a new phase in ransomware operations—where brand diversity masks a centralised, shared infrastructure designed for profit and scalability.
Read more »
Ransomware
Credentialstealing Cyber Security Cybersecurity IdentityTheft infostealers phishing Ransomware

Cybercriminals Shift Tactics Towards Stealth and Identity Theft: IBM X-Force 2025 Report

 

iThe IBM X-Force 2025 Threat Intelligence Index highlights a growing trend of cybercriminals adopting more covert attack strategies. Drawing from analysis of over 150 billion security events daily across 130+ countries, the report notes an 84% spike in email-delivered infostealers in 2024 compared to the previous year. This surge signals a marked pivot towards credential theft, even as enterprise-targeted ransomware attacks show a notable decline.

“Cybercriminals are most often breaking in without breaking anything – capitalising on identity gaps overflowing from complex hybrid cloud environments that offer attackers multiple access points,” said IBM cybersecurity services global managing partner Mark Hughes. “Businesses need to shift away from an ad-hoc prevention mindset and focus on proactive measures such as modernising authentication management, plugging multi-factor authentication holes and conducting real-time threat hunting to uncover hidden threats before they expose sensitive data.”

The report found that critical infrastructure organisations bore the brunt of attacks, accounting for 70% of incidents handled by IBM X-Force last year. More than a quarter of these breaches exploited system vulnerabilities. Data theft (18%) overtook encryption-based attacks (11%) as the preferred method, reflecting improvements in detection tools and increased law enforcement pressure, which have forced threat actors to rethink their strategies.

Asia and North America emerged as the primary targets, together representing almost 60% of all global attacks. Asia faced 34% of the incidents, while North America encountered 24%. For the fourth consecutive year, the manufacturing industry remained the most impacted sector, attributed to its sensitivity to operational disruptions and susceptibility to ransomware.

Emerging AI-related threats also garnered attention. Although no major AI-focused attacks surfaced in 2024, security teams are racing to find and patch vulnerabilities before they are exploited. A critical remote code execution flaw within an AI development framework is expected to gain traction in 2025 as adoption grows. Experts warn that attackers may soon develop dedicated toolkits aimed specifically at AI systems, underlining the urgent need to secure AI infrastructure.Persistent challenges in critical infrastructure security largely stem from outdated technologies and delayed patch management. IBM X-Force revealed that vulnerabilities accounted for over 25% of exploited incidents. Analyzing discussions on dark web forums showed that four of the ten most talked-about CVEs were associated with advanced threat groups, including state-sponsored actors, escalating the risks of disruption and extortion.

Research in collaboration with Red Hat Insights found that over 50% of Red Hat Enterprise Linux users had not patched at least one critical vulnerability, with 18% leaving five or more critical CVEs unaddressed. Moreover, ransomware variants like Akira, Lockbit, Clop, and RansomHub have expanded their capabilities to affect both Windows and Linux systems.

A sharp rise in phishing campaigns distributing infostealers was another key finding, with a 180% jump compared to 2023. The use of credential phishing and infostealers enables hackers to swiftly exfiltrate sensitive information while maintaining a low profile.

While ransomware still accounted for 28% of malware attacks in 2024, its overall prevalence declined compared to previous years. Cybercriminals are increasingly shifting towards identity-based attacks, adapting to countermeasures that have made traditional ransomware operations more difficult.
Read more »
Ransomware
AI Akira Credentials Cyber Crime IBM phishing Ransomware

Cybercriminals Are Now Focusing More on Stealing Credentials Than Using Ransomware, IBM Warns

 



A new report from IBM’s X-Force 2025 Threat Intelligence Index shows that cybercriminals are changing their tactics. Instead of mainly using ransomware to lock systems, more hackers are now trying to quietly steal login information. IBM studied over 150 billion security events each day from 130+ countries and found that infostealers, a type of malware sent through emails to steal data, rose by 84% in 2024 compared to 2023.

This change means that instead of damaging systems right away, attackers are sneaking into networks to steal passwords and other sensitive information. Mark Hughes, a cybersecurity leader at IBM, said attackers are finding ways into complex cloud systems without making a mess. He also advised businesses to stop relying on basic protection methods. Instead, companies should improve how they manage passwords, fix weaknesses in multi-factor authentication, and actively search for hidden threats before any damage happens.

Critical industries such as energy, healthcare, and transportation were the main targets in the past year. About 70% of the incidents IBM helped handle involved critical infrastructure. In around 25% of these cases, attackers got in by taking advantage of known flaws in systems that had not been fixed. Many hackers now prefer stealing important data instead of locking it with ransomware. Data theft was the method in 18% of cases, while encryption-based attacks made up only 11%.

The study also found that Asia and North America were attacked the most, together making up nearly 60% of global incidents. Asia alone saw 34% of the attacks, and North America had 24%. Manufacturing businesses remained the top industry targeted for the fourth year in a row because even short outages can seriously hurt their operations.

Emerging threats related to artificial intelligence (AI) were also discussed. No major attacks on AI systems happened in 2024, but experts found some early signs of possible risks. For example, a serious security gap was found in a software framework used to create AI agents. As AI technology spreads, hackers are likely to build new tools to attack these systems, making it very important to secure AI pipelines early.

Another major concern is the slow pace of fixing vulnerabilities in many companies. IBM found that many Red Hat Enterprise Linux users had not updated their systems properly, leaving them open to attacks. Also, ransomware groups like Akira, Lockbit, Clop, and RansomHub have evolved to target both Windows and Linux systems.

Lastly, phishing attacks that deliver infostealers increased by 180% in 2024 compared to the year before. Even though ransomware still accounted for 28% of malware cases, the overall number of ransomware incidents fell. Cybercriminals are clearly moving towards quieter methods that focus on stealing identities rather than locking down systems.


Read more »
Supermarket
Cybersecurity Data Breach Ransomware Retail Supermarket

Ahold Delhaize Confirms Data Breach Following Cyberattack in U.S. Operations

 

Ahold Delhaize, one of the globe’s leading food retail giants, has officially acknowledged a data breach involving sensitive information from its U.S. operations following a cyberattack in November 2024.

The confirmation followed after ransomware group INC Ransom listed the company on its leak site, sharing alleged stolen documents as proof of the breach.

"Based on our investigation to date, certain files were taken from some of our internal U.S. business systems," a spokesperson for Ahold Delhaize told BleepingComputer. "Since the incident was detected, our teams have been working diligently to determine what information may have been affected."

In November 2024, Ahold Delhaize had disclosed a cybersecurity breach that prompted the temporary shutdown of segments within its IT infrastructure. The disruption impacted some of its U.S. brands and services, including pharmacies and e-commerce operations.

"This issue and subsequent mitigating actions have affected certain Ahold Delhaize USA brands and services including a number of pharmacies and certain e-commerce operations," the company stated at the time.

The investigation remains ongoing. The company has assured that if any personal data is confirmed to be compromised, affected individuals will be notified accordingly.

"If we determine that personal data was impacted, we will notify affected individuals as appropriate. In addition, we have notified and updated law enforcement," Ahold Delhaize added.

While the full impact is yet to be determined, the company emphasized that all stores and online platforms are functioning normally. The spokesperson confirmed that customers should not expect any disruptions as a result of the breach.

As a Dutch-Belgian multinational with over 7,900 stores across Europe, the U.S., and Indonesia, Ahold Delhaize caters to around 72 million shoppers each week, making the protection of customer data critical.
Read more »
Ransomware
Breach Compliance Cybersecurity Data Breach DaVita dialysis Healthcare Hospital incident ITsecurity patientcare Ransomware

DaVita Faces Ransomware Attack, Disrupting Some Operations but Patient Care Continues

 

Denver-headquartered DaVita Inc., a leading provider of kidney care and dialysis services with more than 3,100 facilities across the U.S. and 13 countries, has reported a ransomware attack that is currently affecting parts of its network. The incident, disclosed to the U.S. Securities and Exchange Commission (SEC), occurred over the weekend and encrypted select portions of its systems.

"Upon discovery, we activated our response protocols and implemented containment measures, including proactively isolating impacted systems," DaVita stated in its SEC filing.

The company is working with third-party cybersecurity specialists to assess and resolve the situation, and has also involved law enforcement authorities. Despite the breach, DaVita emphasized that patient care remains ongoing.

"We have implemented our contingency plans, and we continue to provide patient care," the company noted. "However, the incident is impacting some of our operations, and while we have implemented interim measures to allow for the restoration of certain functions, we cannot estimate the duration or extent of the disruption at this time," the company said.

With the investigation still underway, DaVita acknowledged that "the full scope, nature and potential ultimate impact on the company are not yet known."

Founded 25 years ago, DaVita reported $12.82 billion in revenue in 2024. The healthcare giant served over 281,000 patients last year across 3,166 outpatient centers, including 750+ hospital partnerships. Of these, 2,657 centers are in the U.S., with the remaining 509 located in countries such as Brazil, Germany, Saudi Arabia, Singapore, and the United Kingdom, among others. DaVita also offers home dialysis services.

Security experts warn that the scale of the incident could have serious implications.

"There is potential for a very large impact, given DaVita’s scale of operations," said Scott Weinberg, CEO of cybersecurity firm Neovera. "If patient records were encrypted, sensitive data like medical histories and personal identifiers might be at risk. DaVita has not reported data exfiltration, so it’s not clear if data was stolen or not."

Weinberg added, "For dialysis patients needing regular treatments to survive, this attack is extremely serious. Because of disrupted scheduling or inaccessible records, this could lead to health complications. Ransomware disruptions in healthcare may lead to an increase in mortality rates, especially for time-sensitive treatments such as dialysis."

The breach may also bring regulatory challenges due to DaVita’s international footprint.

"Regulations can differ with respect to penalties and reporting requirements after a breach based on the country and even the state in which the patients live or were treated," said Erich Kron, security awareness advocate at KnowBe4.

"A serious cybersecurity incident that affects individuals in multiple countries can be a legal nightmare for some organizations," Kron said. "However, this is something that organizations should plan for and be prepared for prior to an event ever happening. They should already know what will be required to meet regulatory standards for the regions in which they operate."

In a separate statement to Information Security Media Group, DaVita added, "We have activated backup systems and manual processes to ensure there's no disruption to patient care. Our teams, along with external cybersecurity experts, are actively investigating this matter and working to restore systems as quickly as possible."

This cyberattack mirrors similar recent disruptions within the healthcare industry, which continues to be a frequent target.

"The healthcare sector is always considered a lucrative target because of the serious sense of urgency whenever IT operations are disrupted, not to mention potentially disabled," said Jeff Wichman, director of incident response at Semperis. "In case of ransomware attacks, this serves as another means to pressure the victim into paying a ransom."

He added, "At this time, if any systems administering dialysis have been disrupted, the clinics and hospitals within DaVita’s network are most certainly operating machines manually as a last resort and staff are working extremely hard to ensure patient care doesn’t suffer. If any electronic machines in their network are down, the diligence of staff will fill the gaps until electronic equipment is restored."

DaVita joins a growing list of specialized healthcare providers facing cybersecurity breaches in 2025. Notably, Community Care Alliance in Rhode Island recently reported a hack that impacted 115,000 individuals.

In addition, DaVita has previously disclosed multiple health data breaches. The largest, in July 2024, affected over 67,000 individuals due to unauthorized server access linked to the use of tracking pixels in its patient-facing platforms.
Read more »
VPN
At-Bay Cyber Security CyberCrime Cyberhackers CyberThreat Digital Threat RaaS Ransomware remote access VPN

Increasing Exploitation of Remote Access Tools Highlights Ransomware Risks

 


Among the latest findings from cybersecurity insurance provider At-Bay, ransomware incidents witnessed a significant resurgence in 2024, with both the frequency and the severity of these attacks escalating significantly. Based on the firm's 2025 InsurSec Report, ransomware activity rose 20 percent from the previous year, returning to the high level of threat that had been experienced in 2021, when ransomware activity soared to 20 per cent. 

There is an overwhelmingly large number of remote access tools and virtual private networks (VPNS) that have been exploited as entry points for these attacks, according to the report. In particular, mid-market organisations, particularly those with annual revenues between $25 million and $100 million, have been severely hit by this surge, with targeted incidents on the rise by 46 per cent. As a result of the At-Bay claims data, it is apparent that the severity of ransomware breaches has increased by 13 per cent year over year, highlighting how sophisticated and financially destructive these threats are becoming. 

It was also found that attacks originating from third parties, such as vendors and service providers, have increased by 43 per cent, compounding the risk. It is also important to note that the economic toll of these supply chain-related incidents increased by 72 per cent on average, which increased the overall cost associated with them. This study highlights the need to reassess the cybersecurity postures of businesses, especially those that are reliant on remote access infrastructure, as well as strengthen defences across the entire digital ecosystem. 

A study published by At-Bay highlights the widespread misuse of conventional cybersecurity tools, particularly those intended to enhance remote connectivity, as well as the deterioration of the effectiveness of traditional cybersecurity tools. Virtual private networks (VPNS) and remote access software, which are frequently deployed to ensure secure access to internal systems from off-site, are increasingly being repurposed as a gateway for malicious activities. 

As a matter of fact, At-Bay’s analysis illustrates a concerning trend that threatens the flexibility of work environments. Threat actors are frequently exploiting these same tools to get access to corporate networks, extract sensitive data, and carry out disruptive operations. Due to their visibility on the public internet, cybercriminals are actively searching for potential vulnerabilities in these systems to attack them. 

The Remote Access Tools are essentially a front door that provides access to your company's network and can typically be viewed by the general public. For that reason, remote access tools are prone to being attacked by attackers, according to Adam Tyra, Chief Information Security Officer for At-Bay's customer service department. In addition to this, the report highlights the disproportionately high risk posed by mid-sized enterprises, which generate annual revenue of between $25 million and $100 million. 

The number of direct ransomware claims has increased significantly within the segment, which highlights both the increased exposure to cyber threats as well as the potential limitations in resources available to defend against them. As part of this report, the authors point out that “remote” ransomware activity has increased dramatically, a tactic that has gained considerable traction among threat actors over the past few years. 

In 2024, this type of attack is expected to have increased by 50 per cent compared to the year before, representing an astounding 141 per cent increase since the year 2022. As far as traditional endpoint detection systems are concerned, remote ransomware campaigns are typically carried out by unmanaged or personal devices. In these kinds of attacks, rather than deploying a malicious payload directly onto the victim's machine, networks file-sharing protocols are used to access and encrypt data between connected systems by using the network file-sharing protocol. Therefore, the encryption process is often undetected by conventional security tools, such as malware scanners and behaviour-based defences. 

These stealth-oriented methodologies pose a growing challenge to organizations, particularly small and medium-sized businesses (SMBS), as a result of this stealth-oriented methodology. In the study conducted by Sophos Managed Detection and Response (MDR), the most common threat vector in the SMB sector is ransomware and data exfiltration, which accounted for nearly 30 per cent of all cases tracked within this sector. 

Even though sophisticated attack techniques are on the rise, the overall volume of ransomware-related events in 2024 saw a slight decline in volume compared with 2023 despite the rise in sophisticated attack techniques. There has been a marginal decrease in ransomware-as-a-service (Raas) incidents. 

The advancement of defensive technologies and the dismantling of several of the most high-profile ransomware-as-a-service (Raas) operations have both contributed to this decline. This combined study emphasises the urgent need for businesses to modernise their cybersecurity strategies, invest in proactive threat detection, and strengthen the security of their remote access infrastructure to combat cybercrime. 

With the development of ransomware tactics in complexity and scale, the resilience of organisations targeted by these threats has also evolved. As a result of these developments, organisations are increasingly expected to reevaluate their risk management frameworks to adopt a more proactive cybersecurity policy. To ensure that a robust defense strategy is implemented, it is imperative that remote access security systems are secured and access controls are implemented and advanced monitoring capabilities are deployed. 

Besides raising awareness of cybersecurity throughout the workforce and fostering close cooperation between technology and insurance partners, it is also possible to significantly reduce the risk of ransomware being a threat to organisations. In the wake of cyber adversaries that keep improving their methods, businesses will have to take not only technical measures to strengthen their resilience, but also a wide range of strategic measures to anticipate and neutralise emergent attack vectors before they can cause significant damage.
Read more »
VPN
Breach Cyber Security DomainControllers Hackers Ransomware Reconnaissance VPN

Majority of Human-Operated Cyberattacks Target Domain Controllers, Warns Microsoft

 

Microsoft has revealed that nearly 80% of human-operated cyberattacks involve compromised domain controllers, according to a recent blog post published on Wednesday. Alarmingly, in over 30% of these incidents, attackers use the domain controller—a central system in corporate IT networks—to spread ransomware across the organization.

A breached domain controller can give hackers access to password hashes for every user in the system. With these credentials, cybercriminals can identify and exploit privileged accounts, including those held by IT administrators. Gaining control of these accounts allows attackers to escalate their access levels.

"This level of access enables them to deploy ransomware on a scale, maximizing the impact of their attack," Microsoft stated.

One such attack, observed by the tech giant, involved a group known as Storm-0300. The hackers infiltrated a company’s systems by exploiting its virtual private network (VPN). After acquiring administrator credentials, they tried to access the domain controller through the remote desktop protocol (RDP). Once inside, they carried out a series of actions including reconnaissance, bypassing security measures, and escalating their privileges.

Despite the growing frequency of attacks, Microsoft emphasized the difficulty in protecting domain controllers due to their critical role in network management and authentication.

Defenders often face the challenge of “striking the right balance between security and operational functionality,” the blog noted.

To improve protection, Microsoft suggested enhancing domain controllers’ ability to differentiate between legitimate and malicious activity—an essential step toward minimizing server compromises.

Jason Soroko, senior fellow at cybersecurity firm Sectigo, stressed the importance of proactive security measures.

"Ultimately, even the most advanced defense mechanisms may falter if misconfigured or if legacy systems create vulnerabilities. Hence, vigilant customer-side security practices are critical to fortifying these systems against modern cyberthreats," Sectigo said.

While Microsoft offers strong protective tools, their success hinges on users maintaining up-to-date systems and activating features like multifactor authentication.


Read more »
Ransomware
Cyber Crime Everest Gang Hackers Personal Data Ransomware

Cybercriminal Group's Website Taken Over by Unknown Hacker

 


A criminal group known for using ransomware was recently caught off guard when its own website was tampered with. The website, which the gang normally uses to publish stolen data from their victims, was replaced with a short message warning against illegal activity. The message read: “Don’t do crime. CRIME IS BAD. xoxo from Prague.” What a sneaky way to reference gossip girl, isn't it? 

At the time of this report, the website remained altered. It is not yet known if the person or group behind the hack also accessed any files or data belonging to the ransomware gang.

The group, known by the name Everest, has been involved in several cyberattacks since it first appeared in 2020. It is believed to be based in Russia. Over the years, Everest has taken credit for stealing large amounts of data, including information from a popular cannabis store chain, which affected hundreds of thousands of customers. Government agencies in the United States and Brazil have also been listed among their victims.

Ransomware attacks like these are designed to scare companies and organizations into paying money in exchange for keeping their private information from being made public. But recent reports suggest that fewer victims are giving in to the demands. More businesses have started refusing to pay, which has made these attacks less profitable for criminals.

While international law enforcement agencies have had some success in shutting down hacking groups, Everest has managed to stay active. However, this incident shows that even experienced cybercriminals are not safe from being attacked themselves. Some believe this could have been done by a rival group, or possibly even someone from within the gang who turned against them.

It’s also not the first time that cybercrime groups have been sabotaged. In the past few years, other well-known ransomware gangs have faced setbacks due to both police actions and internal leaks.

This unusual case is forces us to face the inevitable reality that no one is completely untouchable online. Whether it’s a company or a hacker group, all digital systems can have weak points. People and organizations should always keep their online systems protected and stay alert to threats.

Read more »
WhiteHat
Compliance Cyber Security Encryption EthicalHacking Firewalls PenTesting Ransomware Vulnerabilities WhiteHat

Ethical Hacking: The Cyber Shield Organizations Need

 

Ethical hacking may sound paradoxical, but it’s one of the most vital tools in modern cyber defence. Known as white hat hackers, these professionals are hired by companies to simulate cyberattacks, uncover vulnerabilities, and help fix them before malicious actors can strike.

“Ethical hackers mimic real-world threats to identify and patch security flaws. It’s about staying a step ahead of the bad guys,” says a cybersecurity expert.

As cyber threats surge globally, ethical hackers are in high demand. A recent Check Point Software report revealed a staggering 44% rise in global cyberattacks. From ransomware gangs to state-sponsored intrusions, the risks are growing—and the need for skilled defenders is greater than ever.

The ethical hacking process begins with reconnaissance—mapping a company’s digital infrastructure. Next comes scanning and vulnerability testing, using the same techniques as criminal hackers. Once issues are identified, they’re reported, not exploited. Some ethical hackers work independently, participating in bug bounty programs for companies like Google and Microsoft.

Industries like finance, healthcare, and tech—where sensitive data is a prime target—rely heavily on ethical hackers. Their techniques include penetration testing, system and network hacking, internal assessments, and web application testing.

In 2019, a team at Positive Technologies uncovered a Visa card flaw that could’ve allowed contactless payments to exceed set limits—just one example of ethical hacking saving the day.

Penetration testing simulates real breaches, such as injecting code, overloading systems, or intercepting data. System hacking targets devices with tools to crack passwords or exploit system weaknesses. Internal testing flags human errors, like weak credentials or poor security training. Web app testing scans for issues like XSS or SQL injections before launch. Network hacking exposes flaws in protocols, open ports, or wireless vulnerabilities.

The biggest advantage? Ethical hackers reveal blind spots that internal teams might miss. They prevent data breaches, build customer trust, and ensure compliance with regulatory standards—saving organizations from reputational and financial harm.

“Finding flaws isn’t enough. Ethical hackers offer the roadmap to fix them—fast,” a security analyst shares.

With the right skills, anyone can break into this field—often with significant rewards. Major companies offer million-dollar payouts through bug bounty programs. Many ethical hackers hold certifications like CEH, OSCP, or CySA+, with backgrounds ranging from military service to degrees in computer science.

The term “hacker” doesn’t always mean trouble. Ethical hackers use the same tools as their criminal counterparts—but to protect, not exploit. In today’s digital battlefield, they’re the unsung heroes safeguarding the future.


Read more »
Ransomware
Data Theft Hunters International malware Ransomware

Cybercrime Group Changes Plans: Drops Ransomware, Focuses on Data Theft

 



A cybercriminal group known for ransomware attacks has decided to stop using those methods and instead focus only on stealing information and demanding money in return. The group, called Hunters International, has rebranded and is now running a new operation.

This group had earlier announced in November 2024 that it would stop its activities. They claimed it was because of low profits and growing attention from police and other authorities. But cybersecurity experts discovered that the group didn’t actually stop – they just changed their approach.

Now, under a new name, World Leaks, the group has returned. Instead of locking people’s files and asking for payment to unlock them, they now secretly steal private data from computers and threaten to release it online unless they’re paid.

According to cybersecurity researchers at Group-IB, the people working with this group are being given a special tool. This software helps them quickly and quietly copy important files from an organization’s systems. It’s believed to be a newer version of a tool they’ve used in the past.

In their earlier version, Hunters International combined two actions: they locked systems (ransomware) and demanded money, and also stole data. But now, they are only stealing data and skipping the system lockout part, which brings less risk and may be harder for authorities to detect.

Hunters International first appeared in late 2023 and was suspected to be connected to an older cyber gang called Hive. Their malware could attack many types of computer systems, including those used by businesses, governments, and servers for virtual machines.

Since then, the group has been behind over 280 attacks on organizations across the globe. They’ve gone after major companies, government bodies, hospitals, and even defense-related firms. In one serious case, they threatened to release personal health records of over 800,000 patients if they weren’t paid.

The group has been targeting companies of all sizes. Experts have seen ransom demands vary, sometimes reaching millions, depending on how large or important the organization is.

Experts say that this shift shows how cybercriminals are always changing tactics to stay ahead. With ransomware becoming riskier and less profitable, many groups may now turn to stealing data as their main method.

To stay safe, organizations should improve their security systems, watch for unusual access, and take steps to protect sensitive data before it’s too late.


Read more »
Ransomware
Cyberattacks Data Privacy Private Information quiet ransomware Ransomware

The Growing Danger of Hidden Ransomware Attacks

 


Cyberattacks are changing. In the past, hackers would lock your files and show a big message asking for money. Now, a new type of attack is becoming more common. It’s called “quiet ransomware,” and it can steal your private information without you even knowing.

Last year, a small bakery in the United States noticed that their billing machine was charging customers a penny less. It seemed like a tiny error. But weeks later, they got a strange message. Hackers claimed they had copied the bakery’s private recipes, financial documents, and even camera footage. The criminals demanded a large payment or they would share everything online. The bakery was shocked— they had no idea their systems had been hacked.


What Is Quiet Ransomware?

This kind of attack is sneaky. Instead of locking your data, the hackers quietly watch your system. They take important information and wait. Then, they ask for money and threaten to release the stolen data if you don’t pay.


How These Attacks Happen

1. The hackers find a weak point, usually in an internet-connected device like a smart camera or printer.

2. They get inside your system and look through your files— emails, client details, company plans, etc.

3. They make secret copies of this information.

4. Later, they contact you, demanding money to keep the data private.


Why Criminals Use This Method

1. It’s harder to detect, since your system keeps working normally.

2. Many companies prefer to quietly pay, instead of risking their reputation.

3. Devices like smart TVs, security cameras, or smartwatches are rarely updated or checked, making them easy to break into.


Real Incidents

One hospital had its smart air conditioning system hacked. Through it, criminals stole ten years of patient records. The hospital paid a huge amount to avoid legal trouble.

In another case, a smart fitness watch used by a company leader was hacked. This gave the attackers access to emails that contained sensitive information about the business.


How You Can Stay Safe

1. Keep smart devices on a different network than your main systems.

2. Turn off features like remote access or cloud backups if they are not needed.

3. Use security tools that limit what each device can do or connect to.

Today, hackers don’t always make noise. Sometimes they hide, watch, and strike later. Anyone using smart devices should be careful. A simple gadget like a smart light or thermostat could be the reason your private data gets stolen. Staying alert and securing all devices is more important than ever.


Read more »
Zoom
BlackSuit Cyberattack Encryption malware phishing Ransomware Zoom

Fake Zoom Download Sites Spreading BlackSuit Ransomware, Experts Warn

 

A new cyberattack campaign is targeting Zoom users by disguising ransomware as the popular video conferencing tool, according to Cybernews. Researchers from DFIR have uncovered a scheme by the BlackSuit ransomware gang, which uses deceptive websites to distribute malicious software.

Instead of downloading Zoom from the official site, unsuspecting users are being lured to fraudulent platforms that closely mimic the real thing. One such site, zoommanager[.]com, tricks users into installing malware. Once downloaded, the BlackSuit ransomware remains dormant for several days before launching its full attack.

The malware first scrapes and encrypts sensitive personal and financial data. Then, victims are presented with a ransom demand to regain access to their files.

BlackSuit has a history of targeting critical infrastructure, including schools, hospitals, law enforcement, and public service systems. The ransomware begins by downloading a malicious loader, which can bypass security tools and even disable Windows Defender.

Researchers found that the malware connects to a Steam Community page to fetch the next-stage server, downloading both the legitimate Zoom installer and malicious payload. It then injects itself into a MSBuild executable, staying inactive for eight days before initiating further actions.

On day nine, it executes Windows Commands to collect system data and deploys Cobalt Strike, a common hacker tool for lateral movement across networks. The malware also installs QDoor, allowing remote access through a domain controller. The final phase involves compressing and downloading key data before spreading the ransomware across all connected Windows systems. Victims’ files are locked with a password, and a ransom note is left behind.

Cybersecurity experts stress the importance of downloading software only from official sources. The genuine Zoom download page is located at zoom[.]us/download, which is significantly different from the deceptive site mentioned earlier.

"Zoom isn't nearly as popular with hackers now as it was a few years ago but given how widely used the service is, it's an easy way to target unsuspecting users online."

To protect against these kinds of attacks, users should remain vigilant about phishing tactics, use reputable antivirus software, and ensure it stays updated. Many modern antivirus tools now offer VPNs, password managers, and multi-device protection, adding extra layers of security.

"As well as making sure you're always downloading software from the correct source, make sure you are aware of common phishing techniques and tricks so you can recognize them when you see them."

It’s also recommended to manually navigate to software websites instead of clicking links in emails or search results, reducing the risk of accidentally landing on malicious clones.
Read more »
Third party breaches
Companies Data Breaches Ransomware Third party breaches

The Growing Danger of Third-Party Security Risks

 


A new study has surfaced a major cybersecurity concern for businesses: security vulnerabilities from third-party partners. According to a recent report by SecurityScorecard, more than a third of all data breaches in 2024 were linked to third-party service providers.


Underreported Threats

The research examined 1,000 cybersecurity incidents across different industries and regions. It found that 35.5% of breaches were due to third-party security weaknesses. However, experts believe the real number may be even higher due to many incidents being misclassified or not reported.


High-Risk Sectors

The report also revealed that the nature of these attacks is changing. In 2025, fewer third-party breaches involved technology services than in previous years. Only 46.75% of such breaches were linked to tech-related businesses, a decline from 75% the year before. This means cybercriminals are targeting a broader range of industries.

Among the most affected industries were retail and hospitality, which experienced the highest rate of third-party security breaches at 52.4%. The technology sector followed closely at 47.3%, while energy and utility companies saw a 46.7% breach rate. Even though the healthcare industry had a lower percentage of breaches (32.2%), it faced the highest total number of attacks, with 78 incidents recorded.


Global Hotspots for Third-Party Breaches

Certain countries saw a higher frequency of breaches. Singapore reported the most third-party cyber incidents, with 71.4% of breaches originating from external vendors. The Netherlands followed at 70.4%, while Japan recorded 60%.

The report also pointed out that ransomware groups are increasingly exploiting third-party connections to gain access to their targets. More than 41.4% of ransomware attacks now originate through a compromised third-party vendor. The notorious Cl0p ransomware gang has been particularly active in using this method.


Strengthening Security Measures

Cybercriminals favor third-party breaches because they allow access to multiple organizations at once. Security experts warn that businesses need to move away from occasional security checks of their vendors and instead implement continuous monitoring. By keeping a close watch on external partners' security measures, companies can reduce the risk of cyber threats before they escalate into major breaches.





Read more »
vulnerabledrivers
Cyber Attacks Cybersecurity Darkweb EDR endpointsecurity ESET Ransomware ransomware-as-a-service vulnerabledrivers

Rise in EDR Killers Signals Growing Threat to Ransomware Detection Systems

 

EDR killers are becoming an increasingly favored tool among ransomware-as-a-service (RaaS) affiliates, with EDRKillShifter emerging as a notable threat. According to a recent report by ESET malware researchers Jakub Souček and Jan Holman, the tool is not alone—there has been a noticeable rise in the variety of EDR killers being used by attackers.

“However, it is not the only EDR killer out there; in fact, ESET researchers have observed an increase in the variety of EDR killers used by ransomware affiliates,” Souček and Holman wrote in the report.

These tools are designed to bypass endpoint detection and response (EDR) solutions that can typically recognize and block encryption payloads used in ransomware attacks. To remain undetected, affiliates rely on EDR killers, which presents a major hurdle for both cybersecurity vendors and internal IT security teams.

ESET’s defense approach includes flagging vulnerable drivers exploited by these tools as potentially unsafe, preventing their activation. The researchers urged organizations to implement similar protective measures.

They referenced the Living Off The Land Drivers (LOLD) project, which tracks over 1,700 vulnerable drivers. However, only a small subset of these are exploited for EDR killer activity, and that number has remained largely consistent.

Identifying and neutralizing these drivers remains a technical challenge. ESET’s analysis highlights how many EDR killers use obfuscated code to dodge early-stage detection. In particular, RansomHub’s EDRKillShifter conceals its shellcode using a 64-character password.

“Without the password, security researchers can neither retrieve the list of targeted process names nor the abused vulnerable driver,” they wrote in the report.

Due to its effectiveness, EDRKillShifter has been adopted by a growing number of affiliates associated with rival ransomware groups since it was released as a service on the dark web.

ESET researchers said they saw a “steep increase” in activity following the release.
Read more »
SaaS Ransomware
2FA Cyber crimes Operational Technology Ransomware SaaS Ransomware

Ransomware Attacks Are Increasing— How Hackers Are Adapting

 



Cybercriminals are finding new ways to launch ransomware attacks, and recent reports show a major increase in these incidents. The latest warning from security experts highlights how hackers are evolving their tactics, making these threats more dangerous than ever.  


Ransomware Attacks Have Risen Sharply  

The number of ransomware attacks has grown in early 2025, with reports showing a 132% increase compared to late 2024. At the same time, a specific type of scam known as deepfake phishing—where AI is used to trick people into giving away sensitive information—has surged by more than 1,600%. These scams often lead to ransomware infections, as hackers use them to gain access to private systems.  

Although many organizations have improved their cybersecurity measures, hackers are adapting. Cybercriminals are focusing on new methods to steal information, including bypassing two-factor authentication (2FA). In many cases, they intercept security codes or hijack login sessions, allowing them to enter accounts without needing passwords.  


Hackers Are Targeting More Systems  

A growing concern is that cybercriminals are now attacking systems that control important operations, such as industrial machines and corporate networks. These systems, known as operational technology (OT) environments, are becoming frequent targets for ransomware groups.  

Security researchers from Ontinue warn that cybercriminals are not just trying to lock files and demand payments— they are using artificial intelligence (AI) and legitimate tools to break into networks without being detected. Instead of relying solely on traditional phishing emails, hackers now interact with IT staff, tricking them into sharing confidential details that can be used for future attacks.  


Ransom Payments Are Declining— But The Threat Isn’t  

One positive trend is that fewer companies are paying ransom demands. Recent studies show that overall payments have dropped by 35%. This is partly due to stronger law enforcement efforts, international cooperation, and organizations refusing to give in to extortion.  

However, experts warn that this might not last. Cybercriminals are constantly adjusting their methods. Instead of just encrypting files, many ransomware groups now steal sensitive data and threaten to leak it unless victims pay up. Some hackers even demand multiple payments—one to prevent data from being leaked, another to unlock encrypted files, and sometimes an additional ransom for other threats.  


The Future of Ransomware Attacks  

Security professionals are seeing a shift in how ransomware works. Hackers are no longer just sending out mass phishing emails. They are carefully studying security systems, looking for vulnerabilities, and even using software-as-a-service (SaaS) platforms to deliver attacks.  

Experts recommend that businesses and individuals take extra precautions. Strengthening cybersecurity defenses, keeping software updated, and being cautious of unexpected emails or messages can help prevent falling victim to these evolving threats.

Read more »
Subscribe to: Posts (Atom)