Acronis Threat Research Unit

A large credential-phishing campaign is actively using open redirector links to bypass security software, according to Microsoft.

Bangkok Airways, which employees more than 3,000 people in 11 countries and has an annual revenue of over $685 million, has announced that they were the victim of a ransomware attack. The LockBit extortion gang is claiming responsibility.

Even as the famed Ragnarok ransomware gang shuts down operations, LockFile ransomware has emerged from the shadows, taking advantage of vulnerabilities like PetitPotam and ProxyShell.

In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent Group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs.

The world’s largest meat supplier, JBS, was forced to halt operations at many of its U.S. and Australian processing plants after a massive cyberattack. This activity threatened supply chains across the world, and resulted in an immediate rise in wholesale red meat prices. This cyberattack, while notable in its own right, is also simply the latest example in a dangerous pattern of escalating ransomware hazards.

DarkSide stands out from other ransomware as a service (RaaS) threats, as one of its attack vectors is based on the Zloader botnet (also known as “Silent Night”). It has also been delivered through compromised third-party service providers.

In the latest incident that illustrates the overlap of the traditional economy and infrastructure with the digital realities of modern business, one of the largest pipelines in the U.S. was forced to shut down this past weekend after being hit by a ransomware group. Managed by Colonial Pipeline Co., the 5,500-mile pipeline runs across 14 states between Houston, TX and New York Harbor, and provides around 45% of all fuel for the U.S. East Coast.

DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021.

In February 2021, the public was shocked by the news of the hacking of Bombardier, a giant in the aerospace industry. During the investigation of the incident, analysts established that the threat group TA505, using the Cl0p ransomware, were responsible for the attack.

The success of the massive SolarWinds supply-chain attack presents an urgent new cybersecurity challenge to every business. We plumb the tactics used in the SolarWinds breach and show how Acronis defends against it and similar attacks.

WastedLocker ransomware was supposedly used by the Evil Corp group, which is known to have delivered Dridex banking malware to attack at least 31 U.S.-based corporations since May 2020. Here we provide an in-depth analysis of WastedLocker, which employs numerous defensive evasion techniques such as digital signing, DLL side-loading, auto-elevation and alternate data streams .

The Nefilim ransomware group, known to be active since February 2020, adopts the Nemty ransomware code written in the Delphi programming language. It uses a Citrix vulnerability/RDP to access corporate networks. Nefilim started its own data leak site called ‘Corporate Leaks,’ where the operators publish exfiltrated data from compromised organizations if they refuse to pay.