Related Families: Xorist, Laplas Clipper
Executive Summary
Cisco Talos recently reported on threat actor activity leveraging MortalKombat ransomware and Laplas Clipper. MortalKombat encrypts files on the infected machine and drops a ransom note instructing victims on how to pay the ransom to recover their files.
Key Takeaways
MortalKombat Ransomware Used in Recent Campaign
Feb 24, 2023 1:57:55 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Cryptocurrency, Laplas Clipper, MortalKombat, Xorist
ESXiArgs Ransomware
Feb 21, 2023 1:20:39 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Linux, ESXiArgs, Babuk, CVE-2021-21974
Related Malware: Babuk
Verticals Targeted: Multiple
Executive Summary
Industry researchers recently reported on ESXiArgs ransomware, which targeted VMware ESXi servers around the globe. After CISA released a recovery script, the threat actors behind ESXiArgs distributed a new variant of the ransomware.
Key Takeaways
Mimic Ransomware
Feb 7, 2023 12:25:08 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Mimic, Everything.exe, Conti
Related Families: Conti
Executive Summary
Trend Micro recently reported on Mimic ransomware, a ransomware family that abuses Everything APIs.
Key Takeaways
Consulate Health Ransomware attack
Jan 18, 2023 2:35:50 PM / by The Hivemind posted in Malware, Ransomware, Hive, Cybercriminals
Ransomware attacks have become a major concern for businesses and organizations in recent years, with devastating consequences for those who fall victim. The Hive ransomware gang, which recently targeted Consulate Health Care, is one example of cybercriminals constructing sophisticated and ruthless tactics to steal sensitive data and extort money from their victims. But how can you protect yourself from these kinds of attacks in the future?
Royal Ransomware
Dec 1, 2022 1:22:05 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Royal, DEV-0569
Executive Summary
Microsoft recently reported on Royal ransomware, a ransomware family used by the threat actor DEV-0569
Azov Ransomware Built to Wipe Data
Nov 17, 2022 1:36:37 PM / by PolySwarm Tech Team posted in Ukraine, Threat Bulletin, Ransomware, Azov
Executive Summary
Azov ransomware is a recently discovered malware family being distributed through pirated software, keygens, and adware bundles. It acts as a wiper and is capable of backdooring 64-bit executables. It also uses a unique pattern for overwriting files.
Recent Threats to the Healthcare Vertical
Nov 14, 2022 12:49:52 PM / by PolySwarm Tech Team posted in Threat Bulletin, Ransomware, Healthcare, Data Theft, Extortion, Data Leak
Verticals Targeted: Healthcare
Executive Summary
Multiple incidents in the last few months highlight the ongoing threats to the Healthcare vertical. These incidents have included data leaks, data theft and extortion, ransomware, and other cyber attacks.
Prestige Ransomware
Nov 3, 2022 2:37:56 PM / by PolySwarm Tech Team posted in Ukraine, Threat Bulletin, Ransomware, Poland, Prestige
Verticals Targeted: Transportation, Logistics
Executive Summary
Microsoft Threat Intelligence Center recently reported on Prestige ransomware. A novel ransomware family used to target entities in Ukraine and Poland in October 2022.