Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server
60
60
60
60
60
60
60
Warning: VMware vCenter and Kemp LoadMaster Flaws Under Active Exploitation
60
60
CISA Alerts on Active Exploitation of Flaws in Fortinet, Ivanti, and Nice Products
60
60
Week in review: Patch Tuesday forecast, 9 free ransomware guides, Cybertech Europe 2023
60
Week in review: Microsoft confirms DDoS attacks on M365 and Azure Portal, Infosecurity Europe 2023
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
An updated joint advisory from CISA, FBI, and HHS states Medusa ransomware has affected more than 500 organizations, spanning healthcare, defense, manufacturing, government, IT, financial services, education, insurance, and legal sectors. Since early 2023 Medusa has operated a ransomware-as-a-service affiliate model and buys access from initial access brokers for $100 to $1 million. Affiliates gain entry via phishing and unpatched internet-facing software, exploiting newly disclosed flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust within 24 hours. The group runs double extortion, giving victims 48 hours before leak-site publication, with $10,000 in cryptocurrency buying a one-day delay.
75
60
60
60
Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.
55
60
CL0P's Ransomware Rampage
60
60
60
Who needs VC funding? How cybercriminals spread their ill-gotten gains to everyday business ventures
60