Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label ransomware protection. Show all posts
Technology
.desktop file abuse AI ransomware detection Drive Google Drive Google Workspace ransomware protection Technology

Google Introduces AI-Powered Ransomware Detection in Drive for Desktop

 

Ransomware continues to be a growing cyber threat, capable of crippling businesses and disrupting personal lives. Losing access to vital files — from cherished family photos to financial records — can have devastating consequences. To tackle this, Google is introducing an AI-powered ransomware detection system for Drive for Desktop, designed to identify threats early and prevent large-scale data loss.

According to Google’s blog post, this new security layer for macOS and Windows continuously monitors for abnormal behavior, such as mass file encryption or corruption — common indicators of a ransomware attack. Unlike traditional antivirus tools that scan for malicious code, Google’s AI model focuses on how files change. When it detects unusual activity, even across a few files, it immediately halts syncing between the user’s device and the cloud. This pause prevents infected files from overwriting safe versions in Google Drive.

Once potential ransomware activity is detected, users receive desktop and email alerts and can access a new recovery interface within Drive. This interface allows them to restore their files to a clean, pre-attack state.

Ransomware remains a significant cybersecurity issue. In 2024, Mandiant reported that ransomware accounted for 21% of all intrusions, with an average cost per incident exceeding $5 million. Critical industries such as healthcare, education, retail, manufacturing, and government are particularly at risk. Google’s approach focuses on a crucial middle ground — between traditional antivirus prevention and post-attack recovery — where AI-driven early intervention can make a major difference.

Google emphasizes that this feature isn’t meant to replace antivirus or endpoint detection tools but to act as an additional safeguard. The system prioritizes commonly targeted file types like Office documents and PDFs, while native Google Docs and Sheets already benefit from built-in protection. Importantly, Google notes that it does not collect user data to train its AI models without explicit consent.

The AI ransomware detection feature is currently rolling out in open beta and will be available at no extra cost for most Google Workspace commercial customers. Individual users will also have access to file recovery tools for free. However, there’s no confirmation yet on whether similar protections will extend to Google Cloud Storage for enterprise users.
Read more »
Security Focused Tools
Cloud Security Cybersecurity Data Privacy Digital Security Encrypted Email Online Safety Privacy ransomware protection Secure Collaboration Security Focused Tools

The Spectrum of Google Product Alternatives


 

It is becoming increasingly evident that as digital technologies are woven deeper into our everyday lives, questions about how personal data is collected, used, and protected are increasingly at the forefront of public discussion. 

There is no greater symbol of this tension than the vast ecosystem of Google products, whose products have become nearly inseparable from the entire online world. It's important to understand that, despite the convenience of this service, the business model that lies behind it is fundamentally based on collecting user data and monetising attention with targeted advertising. 

In the past year alone, this model has generated over $230 billion in advertising revenue – a model that has driven extraordinary profits — but it has also heightened the debate over what is the right balance between privacy and utility.'

In recent years, Google users have begun to reconsider their dependence on Google and instead turn to platforms that pledge to prioritise user privacy and minimise data exploitation rather than relying solely on Google's services. Over the last few decades, Google has built a business empire based on data collection, using Google's search engine, Android operating system, Play Store, Chrome browser, Gmail, Google Maps, and YouTube, among others, to collect vast amounts of personal information. 

Even though tools such as virtual private networks (VPNs) can offer some protection by encrypting online activity, they do not address the root cause of the problem: these platforms require accounts to be accessible, so they ultimately feed more information into Google's ecosystem for use there. 

As users become increasingly concerned about protecting their privacy, choosing alternatives developed by companies that are committed to minimising surveillance and respecting personal information is a more sustainable approach to protecting their privacy. In the past few years, it has been the case that an ever-growing market of privacy-focused competitors has emerged, offering users comparable functionality while not compromising their trust in these companies. 

 As an example, let's take the example of Google Chrome, which is a browser that is extremely popular worldwide, but often criticised for its aggressive data collection practices, which are highly controversial. According to a 2019 investigation published by The Washington Post, Chrome has been characterised as "spy software," as it has been able to install thousands of tracking cookies each week on devices. This has only fueled the demand for alternatives, and privacy-centric browsers are now positioning themselves as viable alternatives that combine performance with stronger privacy protection.

In the past decade, Google has become an integral part of the digital world for many internet users, providing tools such as search, email, video streaming, cloud storage, mobile operating systems, and web browsing that have become indispensable to them as the default gateways to the Internet. 

It has been a strategy that has seen the company dominate multiple sectors at the same time - a strategy that has been described as building a protective moat of services around their core business of search, data, and advertising. However, this dominance has included a cost. 

The company has created a system that monetises virtually every aspect of online behaviour by collecting and interfacing massive amounts of personal usage data across all its platforms, generating billions of dollars in advertising revenue while causing growing concern about the abuse of user privacy in the process. 

There is a growing awareness that, despite the convenience of Google's ecosystem, there are risks associated with it that are encouraging individuals and organisations to seek alternatives that better respect digital rights. For instance, Purism, a privacy-focused company that offers services designed to help users take control of their own information, tries to challenge this imbalance. However, experts warn that protecting the data requires a more proactive approach as a whole. 

The maintenance of secure offline backups is a crucial step that organisations should take, especially in the event of cyberattacks. Offline backups provide a reliable safeguard, unlike online backups, which are compromised by ransomware, allowing organisations to restore systems from clean data with minimal disruption and providing a reliable safeguard against malicious software and attacks. 

There is a growing tendency for users to shift away from default reliance on Google and other Big Tech companies, in favour of more secure, transparent, and user-centric solutions based on these strategies. Users are becoming increasingly concerned about privacy concerns, and they prefer platforms that prioritise security and transparency over Google's core services. 

As an alternative to Gmail, DuckDuckGo provides privacy-focused search results without tracking or profiling, whereas ProtonMail is a secure alternative to Gmail with end-to-end encrypted email. When it comes to encrypted event management, Proton Calendar replaces Google Calendar, and browsers such as Brave and LibreWolf minimise tracking and telemetry when compared to Chrome. 

It has been widely reported that the majority of apps are distributed by F-Droid, which offers free and open-source apps that do not rely on tracking, while note-taking and file storage are mainly handled by Simple Notes and Proton Drive, which protect the user's data. There are functional alternatives such as Todoist and HERE WeGo, which provide functionality without sacrificing privacy. 

There has even been a shift in video consumption, in which users use YouTube anonymously or subscribe to streaming platforms such as Netflix and Prime Video. Overall, these shifts highlight a trend toward digital tools that emphasise user control, data protection, and trust over convenience. As digital privacy and data security issues gain more and more attention, people and organisations are reevaluating their reliance on Google's extensive productivity and collaboration tools, as well as their dependency on the service. 

In spite of the immense convenience that these platforms offer, their pervasive data collection practices have raised serious questions about privacy and user autonomy. Consequently, alternatives to these platforms have evolved and were developed to maintain comparable functionality—including messaging, file sharing, project management, and task management—while emphasizing enhanced privacy, security, and operational control while maintaining comparable functionality. 

Continuing with the above theme, it is worthwhile to briefly examine some of the leading platforms that provide robust, privacy-conscious alternatives to Google's dominant ecosystem, as described in this analysis. Microsoft Teams.  In addition to Google's collaboration suite, Microsoft Teams is also a well-established alternative. 

It is a cloud-based platform that integrates seamlessly with Microsoft 365 applications such as Microsoft Word, Excel, PowerPoint, and SharePoint, among others. As a central hub for enterprise collaboration, it offers instant messaging, video conferencing, file sharing, and workflow management, which makes it an ideal alternative to Google's suite of tools. 

Several advanced features, such as APIs, assistant bots, conversation search, multi-factor authentication, and open APIs, further enhance its utility. There are, however, some downsides to Teams as well, such as the steep learning curve and the absence of a pre-call audio test option, which can cause interruptions during meetings, unlike some competitors. 

Zoho Workplace

A new tool from Zoho called Workplace is being positioned as a cost-effective and comprehensive digital workspace offering tools such as Zoho Mail, Cliq, WorkDrive, Writer, Sheet, and Meeting, which are integrated into one dashboard. 

The AI-assisted assistant, Zia, provides users with the ability to easily find files and information, while the mobile app ensures connectivity at all times. However, it has a relatively low price point, making it attractive for smaller businesses, although the customer support may be slow, and Zoho Meeting offers limited customisation options that may not satisfy users who need more advanced features. 

Bitrix24 

Among the many services provided by Bitrix24, there are project management, CRM, telephony, analytics, and video calls that are combined in an online unified workspace that simplifies collaboration. Designed to integrate multiple workflows seamlessly, the platform is accessible from a desktop, laptop, or mobile device. 

While it is used by businesses to simplify accountability and task assignment, users have reported some glitches and delays with customer support, which can hinder the smooth running of operations, causing organisations to look for other solutions. 

 Slack 

With its ability to offer flexible communication tools such as public channels, private groups, and direct messaging, Slack has become one of the most popular collaboration tools across industries because of its easy integration with social media and the ability to share files efficiently. 

Slack has all of the benefits associated with real-time communication, with notifications being sent in real-time, and thematic channels providing participants with the ability to have focused discussions. However, due to its limited storage capacity and complex interface, Slack can be challenging for new users, especially those who are managing large amounts of data. 

ClickUp 

This software helps simplify the management of projects and tasks with its drag-and-drop capabilities, collaborative document creation, and visual workflows. With ClickUp, you'll be able to customise the workflow using drag-and-drop functionality.

Incorporating tools like Zapier or Make into the processes enhances automation, while their flexibility makes it possible for people's business to tailor their processes precisely to their requirements. Even so, ClickUp's extensive feature set involves a steep learning curve. The software may slow down their productivity occasionally due to performance lags, but that does not affect its appeal. 

Zoom 

With Zoom, a global leader in video conferencing, remote communication becomes easier than ever before. It enables large-scale meetings, webinars, and breakout sessions, while providing features such as call recording, screen sharing, and attendance tracking, making it ideal for remote work. 

It is a popular choice because of its reliability and ease of use for both businesses and educational institutions, but also because its free version limits meetings to around 40 minutes, and its extensive capabilities can be a bit confusing for those who have never used it before. As digital tools with a strong focus on privacy are becoming increasingly popular, they are also part of a wider reevaluation of how data is managed in a modern digital ecosystem, both personally and professionally. 

By switching from default reliance on Google's services, not only are people reducing their exposure to extensive data collection, but they are also encouraging people to adopt platforms that emphasise security, transparency, and user autonomy. Individuals can greatly reduce the risks associated with online tracking, targeted advertising, and potential data breaches by implementing alternatives such as encrypted e-mail, secure calendars, and privacy-oriented browsers. 

Among the collaboration and productivity solutions that organisations can incorporate are Microsoft Teams, Zoho Workplace, ClickUp, and Slack. These products can enhance workflow efficiency and allow them to maintain a greater level of control over sensitive information while reducing the risk of security breaches.

In addition to offline backups and encrypted cloud storage, complementary measures, such as ensuring app permissions are audited carefully, strengthen data resilience and continuity in the face of cyber threats. In addition to providing greater levels of security, these alternative software solutions are typically more flexible, interoperable, and user-centred, making them more effective for teams to streamline communication and project management. 

With digital dependence continuing to grow, deciding to choose privacy-first solutions is more than simply a precaution; rather, it is a strategic choice that safeguards both an individual's digital assets as well as an organisation's in order to cultivate a more secure, responsible, and informed online presence as a whole.
Read more »
Vendor
Cybersecurity Strategy Data Breach Data Breach Cost Extended Enterprise Security IT Risk Management ransomware protection Regulatory Compliance supply chain security third-party risk Vendor

Vendor Data Breaches and Their Business Impact


 

It is evident in the world of digital trust that the financial and reputational costs of a data breach are reaching staggering new heights as the backbone of global commerce becomes increasingly digitally trusted. There is a recent study, Cost of a Data Breach 2025, which shows that the average cost of a single breach has increased by $4.76 million globally, with figures for the US and UK soaring over $9.5 million. 

Finance and healthcare, among other highly targeted sectors where a great deal of sensitive information is at risk, often incur massive losses which often exceed $10 million in damages. However, the monetary settlements and ransomware payouts that usually dominate headlines are only scratching the surface of the crisis. 

Behind the numbers lies a web of hidden expenditures—legal counsel, forensic investigations, regulatory compliance, and extensive recovery efforts—that drain corporate resources years after the initial incident. 

As corrosive as they are, indirect repercussions of a breach are equally as damaging: prolonged downtime that reduces productivity, the cost of fortifying systems against future threats, and the uphill battle it takes to rebuild consumer trust once it has been compromised. 

All these losses are visible and invisible, which illustrates that a security breach is not merely an isolated incident that causes financial losses, but rather is a profound disruption that has a profound impact on the entire organisation. 

Today, third-party data breaches are becoming an increasingly urgent issue for enterprises due to the increasingly interconnected business ecosystems and the increasing complexity of global supply chains, which make them one of the most pressing challenges they face. Research by the industry suggests that nearly one-third of all breaches occur as a result of external vendors, a figure that has nearly doubled over the last year. 

It is not just a matter that these incidents have become more prevalent, but also that they are the most costly ones. According to IBM's latest Cost of a Data Breach Report, third parties are the most reliable predictors of increased breach costs, adding on average 5 per cent more to the already staggering financial burden. There are several reasons behind the rise of this rate. 

The large companies of the world have invested heavily in advanced cybersecurity frameworks over the past decade, which makes direct compromise more difficult for attackers. Because of this, cybercriminals are increasingly turning to smaller subcontractors, suppliers, and service providers whose defences are often weaker. 

Threat actors are able to gain access to larger organizations' systems through trusted connections by infiltrating these weaker links, such as small IT vendors, logistics providers, and even HVAC contractors, by exploiting trusted connections. In particular, for industries that heavily rely on vendor networks that are extremely intricate, indirect infiltration has proven particularly devastating. 

Although small businesses are prime targets for hackers—with 43 per cent of attacks being directed at them—they continue to face significant challenges in adopting comprehensive security practices despite being prime targets. 

There are many consequences associated with such breaches that are much greater than just direct financial losses. They often result in costly regulatory penalties, litigation, and long-term reputational damage that can undermine trust across entire supply chains, resulting in long-term consequences. 

Over the past few years, it has been observed with stark clarity that even the most established businesses remain vulnerable to vendor failures and cyberattacks, including those caused by vendor failures. One of the four data centres operated by the French cloud service provider OVHcloud was destroyed by fire in 2021. The disruption unfolded in a major way. 

A temporary outage of millions of websites, including bank websites, government websites, and major e-commerce platforms across Europe, resulted in a temporary suspension of service. While backups were present, the event revealed critical shortcomings in disaster recovery planning, which led to the loss of millions of dollars of business and data exposure. 

Similar vulnerabilities have been exposed in other high-profile cases as well. There were several breaches in recent months, including Orange Belgium compromising the personal information of 850,000 customers, Allianz Life exposing the data of more than one million policyholders, and Qantas exposing the personal information of more than six million customers, which affected more than six million customers in total. 

Ransomware attacks, targeting the technology providers of the National Health Service, Advanced Computer Systems, disrupted essential hospital services, including blood testing, in the United Kingdom and are associated with at least one patient's tragic death. As a result of this breach, the company was fined £3 million, a penalty which underscored its responsibility but did not come until irreversible harm had been done to the company. 

There is a recurring pattern in the cases: vulnerabilities are not generally caused by a lack of investment on the part of the primary organisation but rather by vulnerabilities in their vendors' infrastructures. It is well known that weak backup systems, inadequate disaster recovery frameworks, and reliance on manual responses can exacerbate the consequences of any breach or outage. 

However, even when basic safeguards are in place, such as data integrity checks, a lack of rigour in implementation leaves critical systems vulnerable. This is the result of NVIDIA's cascading effect—where failures on the virtualisation platform cause widespread operational disruptions, financial losses, regulatory penalties, and, in the case of most NVIDIAs, the loss of lives.

In order to effectively mitigate third-party risks, companies need to go beyond superficial oversight and take a structured, proactive approach throughout the entire lifecycle of their vendors. The experts at the Institute for Information Technology and Innovation emphasise that organisations must begin by integrating security considerations into their vendor selection and sourcing processes. 

Companies that handle sensitive data or operate in highly regulated industries are advised to prioritise partners who demonstrate that their security maturity is in order, have a proven record of compliance with frameworks such as HIPAA, GDPR, or CMMC, and have a track record of no repeated breaches. It is possible to gain deeper insights into potential partners by utilising vendors' risk intelligence platforms or third-party monitoring tools before potential vulnerabilities become systemic threats. 

The contract should be clear about how sensitive data will be stored, accessed, and transferred, including relationships with third parties and even fourth parties. Once the contract is signed, the expectations must be clearly stated. Unless these issues are addressed, organisations run the risk of losing control of confidential information as it travels across vast digital ecosystems. 

Continuous monitoring is equally critical. In order to ensure that vendors that have access to proprietary information or proprietary systems are regularly examined, not only for malicious intent, but also for inadvertent lapses that could allow malware or unauthorised entry, it is crucial to routinely analyse vendors who have access. 

By monitoring external channels, including the dark web, organisations can take measures to get early warnings when credentials have been stolen or data has been compromised. With more and more regulatory frameworks like GDPR, CCPA, and the NY Shield Act coming into effect, compliance obligations have become increasingly demanding, and non-compliance has serious financial and reputational consequences. 

It has been argued that in some industries, third-party certifications, such as the SOC 2, NIST CSF, or the Department of Defence Cybersecurity Maturity Model Certification, can strengthen accountability by ensuring that vendors independently verify their security postures. The issue of vendor offboarding, often overlooked by organisations, is a challenging one that organisations need to address, as well as onboarding and oversight. 

A failure to properly revoke departmental access once a contract is completed can result in lingering vulnerabilities that could be exploited even years after the partnership has ended. As a result, regular audits of the offboarding process are necessary for the protection of assets and compliance with government regulations. Finally, it is becoming increasingly important to have a clear view of the extended supply chain. 

A number of high-profile attacks on software companies, such as SolarWinds and Kaseya, have demonstrated the potential for a cascading effect at the fourth-party level, causing widespread damage across industries. Defining vendor networks and demanding greater transparency will allow organisations to minimise blind spots and minimise the ripple effects of breaches originating far beyond their immediate control, thereby preventing the spread of these breaches. 

Increasingly, organisations have recognised that cybersecurity is no longer purely an internal responsibility, but a shared responsibility for everyone in their supply chain, as breaches related to vendors continue to rise. By taking an integrated approach to vendor risk management, not only will companies be able to mitigate financial and operational damage, but they will also strengthen their resilience to evolving cyber threats in the future. 

A company that invests in comprehensive risk assessments, maintains continuous monitoring, and enforces rigorous contractual obligations with its vendors has a better chance of detecting vulnerabilities before they escalate. In addition, implementing structured offboarding procedures, requiring third-party certifications, and maintaining visibility into extended vendor networks can also lead to a significant reduction in the risk of both direct and cascading attacks. 

Beyond compliance, these measures foster trust with customers, partners, and stakeholders, reinforcing a brand's credibility in a digitally dominated market by consumers, partners, and stakeholders. As long as organisations integrate cybersecurity into each step of the vendor lifecycle—from selection and onboarding to monitoring and offboarding—they safeguard sensitive information, ensure continuity and operational efficiency, and maintain the reputation of the organisation. 

When a single weak link in the electronic system can compromise millions of records, adopting a future-oriented, proactive strategy can transform cybersecurity from a reactive necessity to a competitive advantage that offers both long-term business value and protects against long-term threats.
Read more »
ransomware protection
business cyber risks cloud data security Cyber Attacks cyberattack myths cybersecurity for small business cybersecurity insurance ransomware protection

5 Cybersecurity Myths Undermining Your Business Resilience

 


Decades ago, even multinational companies operated efficiently without screens or digital systems. Cyberattacks weren’t on anyone’s radar.

Today, technology is the backbone of nearly every business—and with it comes an evolving set of risks. Yet persistent misconceptions still prevent leaders from proactively safeguarding their operations. Here are five of the most damaging myths—and why addressing them is imperative.

1. “Cybercrime only happens to others”

It’s a common mindset to assume cyberattacks won’t happen to you. In reality, incidents have surged over 300% since 2021, as reported in the Microsoft Digital Defense Report.

“A bad actor, thousands of kilometers away, can stop all the farm’s robots cold. Stop the cows from being milked and send a nice email for a ransom.”

If your organization depends on connected systems—and generates revenue—you are inherently exposed.

2. “We’re too small to be attacked”

Many believe only large enterprises are targets. But cybercriminals operate sophisticated networks that indiscriminately attack thousands of businesses in parallel.

“Not lone fishermen, but fleets of trawlers capturing all they can, by the ton.”

Small and medium enterprises are often the primary targets simply because they outnumber large corporations—and are less prepared.

3. “We have nothing worth stealing”

If you run a business, you hold assets that cybercriminals value—financial data, customer records, intellectual property, and more.

“They will spend months in your systems… until they have figured out two things: what is important to you and how much you are willing (and able) to pay to get it back.”

Attackers exploit this intelligence to maximize leverage in a ransom scenario.

4. “Our data is safe in the cloud”

Cloud providers secure their infrastructure, but protecting your data is your responsibility.

“Picture that you are hiring a security company. They will guard the access to your lot… but they will not manage what happens inside your house.”

Relying solely on cloud providers without internal safeguards leaves critical gaps.

5. “We have adequate insurance”

Insurance can help recover losses—but it does not prevent attacks or mitigate immediate damage.

“Far better – and usually much cheaper – to avoid a fire than to recover from one.”

A robust strategy requires proactive defenses, detection, and response capabilities—not just financial coverage.

“I strongly believe in making cybersecurity accessible, so that all business owners are in a position to understand and support cybersecurity initiatives within their company.”

As a leader, it’s your responsibility to challenge outdated beliefs. If your business has valuable data, reputation, or revenue streams, you are a potential target.

Approach cybersecurity with the same diligence as locking your office doors. Your assets are worth protecting. Take proactive measures now—before an attack forces you to rebuild from scratch.
Read more »
targeting VMware ESXi systems
Cyber Security cybersecurity threat ESXi environments Linux Security New Linux ransomware Play ransomware variant ransomware attacks ransomware protection targeting VMware ESXi systems

New Linux Play Ransomware Variant Targets VMware ESXi Systems

 

Attacks with a new Play ransomware variant for Linux have been deployed against VMware ESXi systems, most of which have been aimed at the U.S. and at organizations in the manufacturing, professional services, and construction sectors, according to The Hacker News.

Such a novel Play ransomware version was hosted on an IP address that also contained the WinSCP, PsExec, WinRAR, and NetScan tools, as well as the Coroxy backdoor previously leveraged by the ransomware operation, indicating similar functionality, an analysis from Trend Micro revealed. However, additional examination of the payload showed its utilization of a registered domain generation algorithm to bypass detection, a tactic similarly used by the Prolific Puma threat operation. 

"ESXi environments are high-value targets for ransomware attacks due to their critical role in business operations. The efficiency of encrypting numerous VMs simultaneously and the valuable data they hold further elevate their lucrativeness for cybercriminals," said researchers. Cybersecurity researchers have discovered a new Linux variant of a ransomware strain known as Play (aka Balloonfly and PlayCrypt) that's designed to target VMware ESXi environments.

"This development suggests that the group could be broadening its attacks across the Linux platform, leading to an expanded victim pool and more successful ransom negotiations," Trend Micro researchers said in a report published Friday.

Play, which arrived on the scene in June 2022, is known for its double extortion tactics, encrypting systems after exfiltrating sensitive data and demanding payment in exchange for a decryption key. According to estimates released by Australia and the U.S., as many as 300 organizations have been victimized by the ransomware group as of October 2023.

Statistics shared by Trend Micro for the first seven months of 2024 show that the U.S. is the country with the highest number of victims, followed by Canada, Germany, the U.K., and the Netherlands. Manufacturing, professional services, construction, IT, retail, financial services, transportation, media, legal services, and real estate are some of the top industries affected by the Play ransomware during the time period.

The cybersecurity firm's analysis of a Linux variant of Play comes from a RAR archive file hosted on an IP address (108.61.142[.]190), which also contains other tools identified as utilized in previous attacks such as PsExec, NetScan, WinSCP, WinRAR, and the Coroxy backdoor.

"Though no actual infection has been observed, the command-and-control (C&C) server hosts the common tools that Play ransomware currently uses in its attacks," it said. "This could denote that the Linux variant might employ similar tactics, techniques, and procedures (TTPs)."

The ransomware sample, upon execution, ensures that it's running in an ESXi environment before proceeding to encrypt virtual machine (VM) files, including VM disk, configuration, and metadata files, and appending them with the extension ".PLAY." A ransom note is then dropped in the root directory.

Further analysis has determined that the Play ransomware group is likely using the services and infrastructure peddled by Prolific Puma, which offers an illicit link-shortening service to other cybercriminals to help them evade detection while distributing malware. Specifically, it employs what's called a registered domain generation algorithm (RDGA)
Read more »
Subscribe to: Comments (Atom)