Browse articles in Security Research

AVOS Locker ransomware operators are claiming to have stolen sensitive data from Pacific City Bank, a California-based bank focused on serving the Korean-American community.

Mozilla has released version 92 of their Firefox browser. This update includes a mixture of security improvements and critical fixes, including patches for multiple high-severity vulnerabilities pertaining to memory corruption.

A large credential-phishing campaign is actively using open redirector links to bypass security software, according to Microsoft.

Bangkok Airways, which employees more than 3,000 people in 11 countries and has an annual revenue of over $685 million, has announced that they were the victim of a ransomware attack. The LockBit extortion gang is claiming responsibility.

Even as the famed Ragnarok ransomware gang shuts down operations, LockFile ransomware has emerged from the shadows, taking advantage of vulnerabilities like PetitPotam and ProxyShell.

In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent Group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs.

The world’s largest meat supplier, JBS, was forced to halt operations at many of its U.S. and Australian processing plants after a massive cyberattack. This activity threatened supply chains across the world, and resulted in an immediate rise in wholesale red meat prices. This cyberattack, while notable in its own right, is also simply the latest example in a dangerous pattern of escalating ransomware hazards.

DarkSide stands out from other ransomware as a service (RaaS) threats, as one of its attack vectors is based on the Zloader botnet (also known as “Silent Night”). It has also been delivered through compromised third-party service providers.

In the latest incident that illustrates the overlap of the traditional economy and infrastructure with the digital realities of modern business, one of the largest pipelines in the U.S. was forced to shut down this past weekend after being hit by a ransomware group. Managed by Colonial Pipeline Co., the 5,500-mile pipeline runs across 14 states between Houston, TX and New York Harbor, and provides around 45% of all fuel for the U.S. East Coast.

DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021.

In February 2021, the public was shocked by the news of the hacking of Bombardier, a giant in the aerospace industry. During the investigation of the incident, analysts established that the threat group TA505, using the Cl0p ransomware, were responsible for the attack.

The success of the massive SolarWinds supply-chain attack presents an urgent new cybersecurity challenge to every business. We plumb the tactics used in the SolarWinds breach and show how Acronis defends against it and similar attacks.