Executive Summary
Multiple ransomware families have been used to target the healthcare vertical in the past year. In this report, we cover recently reported attacks on the healthcare vertical leveraging Maui and Quantum ransomware families.
Recent Ransomware Threats to Healthcare
Jul 21, 2022 1:27:35 PM / by PolySwarm Tech Team posted in Threat Bulletin, North Korea, Ransomware, Iran, IcedID, Healthcare, Maui, Quantum, Hospital
HavanaCrypt Distributed Via Fake Google Software Update
Jul 18, 2022 12:04:52 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, HavanaCrypt
Executive Summary
Trend Micro recently reported on HavanaCrypt ransomware, which is being distributed disguised as a fake Google software update.
Lockbit 3.0
Jul 14, 2022 1:29:24 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, LockBit, Lockbit 3.0, LockbitBlack
Executive Summary
Cluster25 recently reported on Lockbit 3.0, the latest version of Lockbit ransomware. Version 3.0 includes new features and a ransomware bug bounty program.
New Hive Ransomware Rust Variant
Jul 11, 2022 1:37:20 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Hive, Rust
Executive Summary
Microsoft recently reported on a new variant of Hive ransomware written in Rust. This is a departure from previous versions, which were written in GoLang.
Key Takeaways
SessionManager Targets Governments and NGOs
Jul 8, 2022 2:33:33 PM / by PolySwarm Tech Team posted in Threat Bulletin, Government, Backdoor, SessionManager, NGO, IIS
Executive Summary
Kaspersky recently reported on SessionManager, a difficult to detect backdoor targeting governments and NGOs in multiple countries.
Black Basta Ransomware
Jul 5, 2022 3:33:54 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Windows, Linux, Black Basta, Qbot
Executive Summary
Cybereason recently reported on Black Basta ransomware, which has claimed around 50 victims so far, making it a prominent threat.
Cerber2021 Targets Windows and Linux
Jun 30, 2022 1:18:47 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Cerber, CerberImposter, CVE-2022-26134, Cerber2021
Executive Summary
Cyble recently reported on the resurgence of Cerber2021 ransomware, which targets both Windows and Linux systems.
Key Takeaways
PingPull Targets Telecom, Government, and Financial Verticals
Jun 27, 2022 3:56:10 PM / by PolySwarm Tech Team posted in Threat Bulletin, Financial, Government, Telecommunications, PingPull, Gallium
Executive Summary
Palo Alto’s Unit42 recently reported on PingPull, a RAT used by the Gallium threat actor group to target entities in the telecommunications, government, and financial verticals.