IT-ISAC

The Q2 2024 update to our Ransomware Report, "Exploring the Depths: An Analysis of the 2023 Ransomware Landscape and Insights for 2024," is now available! See our analysis of 2024's trends so far, tips on ransomware mitigation, and more! Read here: https://bit.ly/3zWchA5

Cyberbyte time! A new Linux variant of Play #Ransomware specifically targets VMWare ESXi environments. Trend Micro researchers also discovered a connection to Prolific Puma threat group through examining the URL used to host the ransomware. https://lnkd.in/eB8mxkHp

Monday CyberByte! In the wake of last Friday's CrowdStrike outage, threat actors have distributed a malicious ZIP archive, "crowdstrike-hotfix". The ZIP contains a HijackLoader payload that when executed, loads RemCos, a remote access trojan. https://lnkd.in/dDDusnNK

Here's today's CyberByte: The Revolver Rabbit threat group has registered over 500,000 domain names for infostealer campaigns targeting Windows and macOS systems. Registered domain generation algorithms enable them to register many domain names quickly. https://lnkd.in/gVrqdXSa

Today's CyberByte! APT17, a China-linked threat actor, has targeted Italian companies and government entities using a variant of 9002 RAT #malware. Two recent attacks involved spear-phishing techniques that delivered the malware via a fake Skype package https://lnkd.in/gZkWW7Dm

Have a CyberByte! Cybercriminals exploit legitimate URL protection services to disguise phishing links. The sites usually deter phishing by rewriting URLs, but instead can be compromised to mask URLs and point victims to sites that steal credentials. https://lnkd.in/erYcMF3y

Happy Friday! Close the week with a CyberByte! Threat actor CRYSTALRAY has expanded; the actor has now impacted over 1,500 victims through the use of SSH-Snake. Its scale has increased tenfold since February. https://lnkd.in/gXtCF2V7

Middle of the week CyberByte! Poco RAT, a new remote access trojan, is named because it utilizes POCO C++ libraries for evasion. The trojan has been spreading via email campaigns and has been used in particular to target the Latin American mining sector. https://lnkd.in/egwUtxtU

Here's a CyberByte! A new RaaS Ransomware strain, "Eldorado", is targeting Windows and VMware ESXi hypervisors. The strain emerged in March and has claimed 16 victims from a variety of sectors, including healthcare and manufacturing. https://lnkd.in/gamh5Zk5

Happy July 4th from the team at IT-ISAC! Have a fun and safe holiday!