Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Aug 17, 2022

BlackByte ransomware gang is back with new extortion tactics
August 17, 2022

The BlackByte ransomware is back with version 2.0 of their operation, including a new data leak site utilizing new extortion techniques borrowed from LockBit.

After a brief disappearance, the ransomware operation is now promoting a new data leak site on hacker forums and through Twitter accounts the threat actor controls.
The threat actors are calling this new iteration of their operation BlackByte version 2.0, and while it is not clear if the ransomware encryptor has changed as well, the gang has launched a brand new Tor data leak site.
Click to expand...

The data leak site only includes one victim at this time but now has new extortion strategies that allow victims to pay to extend the publishing of their data by 24 hours ($5,000), download the data ($200,000), or destroy all the data ($300,000). These prices will likely change depending on the size/revenue of the victim.

However, as pointed out by cybersecurity intelligence firm KELA, BlackByte's new data leak site is not correctly embedding the Bitcoin and Monero addresses that "customers" can use to purchase or delete the data, making these new features currently broken.
The goal of these new extortion techniques is to allow the victim to pay to remove their data and for other threat actors to purchase it if they wish.
Click to expand...

Who is BlackByte?
The BlackByte ransomware operation launched in the summer of 2021 when the hackers began breaching corporate networks to steal data and encrypt devices.

Their highest-profile attack was against the NFL's 49ers, but a joint advisory from the FBI and Secret Service says they were also responsible for attacks on critical infrastructure sectors, including government facilities, financial, and food & agriculture.
Click to expand...

guest · Aug 22, 2022

LockBit claims ransomware attack on security giant Entrust, leaks data
August 18, 2022

The LockBit ransomware gang has claimed responsibility for the June cyberattack on digital security giant Entrust.

Last month, BleepingComputer broke the story that Entrust suffered a ransomware attack on June 18th, 2022.
Starting in early June, Entrust had begun to tell customers that they suffered a cyberattack where data was stolen from internal systems.

"We have determined that some files were taken from our internal systems," Entrust shared in a security notification to customers.
Click to expand...

LockBit claims attack on Entrust
Today, security researcher Dominic Alvieri told BleepingComputer that LockBit had created a dedicated data leak page for Entrust on their website, stating that they would publish all of the stolen data tomorrow evening.

When ransomware gangs publish data on their data leak sites, they usually leak data over time to scare the victim into returning to the negotiation table.
As LockBit states that they will publish all data, it indicates that Entrust has not negotiated with the ransomware operation or refuses to give in to their demands.
Click to expand...

However, LockBit claiming of the attack supports what sources had previously told BleepingComputer about who was responsible.

LockBit is considered one of the most active ransomware operations at this time, with its public-facing operation 'LockBitSupp' actively engaging with threat actors and cybersecurity researchers.
Click to expand...

Update 8/21/22:

LockBit leaks alleged Entrust data
LockBit began leaking Entrust's data Friday evening, first sharing screenshots of some of the allegedly stolen data, with the threat actors saying they would leak further data later that evening.

However, soon after they began leaking data, the ransomware gang's Tor data leak sites went offline, with the threat actors claiming that they are being DDoSed due to the Entrust attack.
Click to expand...

guest · Aug 22, 2022

LockBit ransomware blames Entrust for DDoS attacks on leak sites
August 22, 2022

The LockBit ransomware operation's data leak sites have been shut down over the weekend due to a DDoS attack telling them to remove Entrust's allegedly stolen data.

Last week, LockBit claimed responsibility for the attack and began leaking data Friday evening.
This leak consisted of 30 screenshots of data allegedly stolen from Entrust, including legal documents, marketing spreadsheets, and accounting data.
Click to expand...

Soon after they started leaking data, researchers began reporting that the ransomware gang's Tor data leak sites were unavailable due to a DDoS attack.

Yesterday, security research group VX-Underground learned from LockBitSupp, the public-facing representative of the LockBit ransomware operation, that their Tor sites were under attack by someone they believed to be connected to Entrust.

"Ddos attack began immediately after the publication of data and negotiations, of course it was them, who else needs it? In addition, in the logs there is an inscription demanding the removal of their data," LockBitSupp told BleepingComputer in response to the questions about the attack.
Cisco Talos researcher Azim Shukuhi tweeted that the DDoS attack on LockBit's servers consisted of "400 requests a second from over 1000 servers."
Click to expand...

In retaliation to the attack, LockBit's data leak sites now show a message warning that the ransomware gang plans to upload all of Entrust's data as a torrent, which will make it almost impossible to take down.
Click to expand...

guest · Aug 22, 2022

Greek natural gas operator suffers ransomware-related data breach
August 22, 2022

Greece's largest natural gas distributor DESFA confirmed on Saturday that they suffered a limited scope data breach and IT system outage following a cyberattack.

In a public statement shared with local news outlets on Saturday, DESFA explained that hackers attempted to infiltrate its network but were thwarted by the quick response of its IT team.
However, some files and data were accessed and possibly "leaked," so there was a network intrusion, even if limited.
Click to expand...

Finally, DESFA declares an unwavering stance against communicating with cyber criminals, so there will be no negotiation of a ransom payment.
Ragnar Locker claims responsibility
The confirmation of the attack comes after data was leaked on Friday by the Ragnar Locker ransomware operation, a threat actor that began operations over two years ago and has had numerous high-profile attacks in 2021.

The threat actors posted a list of allegedly stolen data on their data leak/extortion portal and a small set of stolen files that don't appear to include classified information.
Moreover, Ragnar Locker says they've found multiple security vulnerabilities on DESFA's systems and informed them of the fact, likely as part of their extortion attempt. However, the threat actors allegedly did not respond to them.
Click to expand...

The ransomware actors threaten to publish all files corresponding to the file tree if the victimized organization doesn't meet their demands.
Click to expand...

guest · Aug 23, 2022

New 'Donut Leaks' extortion gang linked to recent ransomware attacks
August 23, 2022

A new data extortion group named 'Donut Leaks' is linked to recent cyberattacks, including those on Greek natural gas company DESFA, UK architectural firm Sheppard Robson, and multinational construction company Sando.

Two victims disclosed these attacks without much information regarding who was involved.
Click to expand...

Over the weekend, DESFA confirmed they suffered a cyberattack after Ragnar Locker leaked screenshots of allegedly stolen data.
Earlier this month, Sheppard Robson disclosed a ransomware attack and an extortion attempt but did not provide details about who hacked its network.
Finally, Hive Ransomware claimed last month to have attacked Sando but only released a small archive of files as 'proof' of the attack.

Strangely, the data for these victims have now appeared on the data leak site for a previously unknown extortion gang known as Donut Leaks. Furthermore, the data shared on the Donut Leaks site is far more extensive than that shared on the ransomware sites, indicating that this new threat actor was involved in the attacks.
Click to expand...

Who are Donut Leaks?
BleepingComputer first learned of the Donut Leaks extortion group from an employee of one of the victims, who told us that the threat actors breached the corporate network to steal data.

The stolen data storage server runs the File Browser application, which allows visitors to browse through all of the stolen data stored on the server, broken down by the victim.
While there are only five victims listed on the shaming site, the storage server contains what appears to be ten victims.
Click to expand...

It is unknown whether the threat actors deploy ransomware when breaching networks or are simply a data extortion group.

However, Sheppard Robson did disclose that their recent attack was a ransomware attack.

"As is typical with a ransomware attack, the criminals contacted us for purposes of extortion," disclosed Sheppard Robson.
Furthermore, two different ransomware operations claimed responsibility for DESFA (Ragnar Locker) and SANDO (Hive).
This likely means that the threat actor running Donut Leaks is a pen tester or an affiliate for both Hive, Ragnar Locker, and possibly other ransomware operations.
Click to expand...

guest · Aug 23, 2022

Major airline technology provider Accelya attacked by ransomware group
August 23, 2022

A technology provider for many of the world’s largest airlines said it recently dealt with a ransomware attack impacting some of its systems.

Accelya – a technology firm providing services to Delta, British Airways, JetBlue, United, Virgin Atlantic, American Airlines and many more – confirmed Tuesday that two of the security firms it hired to address the incident discovered that company data was posted on a ransomware leak site.
The AlphV/Black Cat ransomware group published data it allegedly stole from Accelya last Thursday. The group claimed to have stolen emails, worker contracts and more.
Click to expand...

“Our forensic investigators confirmed it was limited to a contained portion of our overall environment. We have no evidence to indicate that the malware could have moved laterally from our systems to our customers’ environments,” the spokesperson said.

They added that the company is going over the data published to the AlphV leak site last week and will notify any customers who had information exposed.
Click to expand...

AlphV/Black Cat continues to be one of the most prolific ransomware groups, with attacks over the last month on the city government of Alexandria, Louisiana and several universities throughout the spring.

The group attacked two energy companies in Luxembourg and Japanese video game giant Bandai Namco last month
Click to expand...

guest · Sep 3, 2022

RansomEXX claims ransomware attack on Sea-Doo, Ski-Doo maker
By Bill Toulas @billtoulas - August 24, 2022

The RansomEXX ransomware gang is claiming responsibility for the cyberattack against Bombardier Recreational Products (BRP), disclosed by the company on August 8, 2022.

At the time, the Canadian maker of Ski-Doo snowmobiles, Sea-Doo jet skis, ATVs, motorcycles, watercrafts, and Rotax engines informed the public of a temporary stop for all operations as a response to "malicious cyberactivity."
The operational halt impacted production, too, and was expected to cause delays in certain transactions with customers and suppliers.
Click to expand...

On August 15, 2022, BRP provided an update on the situation, saying that four manufacturing sites in Canada, Finland, the U.S., and Austria resumed production, with the rest to follow suit by the end of that week.

In the same statement, the company presented the first results of its internal investigation, saying that the hackers breached its systems via a supply chain attack.

"The Company confirms that the malware infiltration came through a third-party service provider. BRP believes that the impact of the cyberattack was limited to its internal systems," the company states.
Click to expand...

RansomEXX leaks files
Yesterday, the RansomEXX gang listed Bombardier Recreational Products on its leak site along with 29.9GB of files allegedly stolen from the firm.

The samples provided on the onion site include non-disclosure agreements, passports and IDs, material supply agreements, contract renewals, and more.
It appears that the data breach doesn't include sensitive customer data, yet the exposure of the said documents is still damaging for BRP.
Click to expand...

Bombardier Recreational Products issued a statement today confirming that the leaked documents are authentic, adding that it is actively supporting impacted parties to mitigate the negative effects due to the exposure.

"BRP confirms that it has already contacted the very few employees who may have been impacted by the incident. The appropriate resources have been made available to them, including credit monitoring services" - Bombardier Recreational Products
Click to expand...

guest · Sep 3, 2022

Quantum ransomware attack disrupts govt agency in Dominican Republic
By Lawrence Abrams @LawrenceAbrams - August 24, 2022

The Dominican Republic's Instituto Agrario Dominicano has suffered a Quantum ransomware attack that encrypted multiple services and workstations throughout the government agency.

The Instituto Agrario Dominicano (IAD) is part of the Ministry of Agriculture and is responsible for executing Agrarian Reform programs in the country.
Local media reports that the ransomware attack occurred on August 18th, which has impacted the agency's operation.

"They ask for more than 600 thousand dollars. We were affected by four physical servers and eight virtual servers; virtually all servers," IAD Director of Technology Walixson Amaury Nuñez told local media.
The National Cybersecurity Center (CNCS), which has been assisting the agency recover from the attack, says that the IP addresses of the attackers were from the U.S. and Russia.
Click to expand...

Quantum ransomware behind the attack
BleepingComputer learned of the attack today from VenezuelaBTH, who said the agency was unlikely to pay a ransom as they cannot afford to do so.

Our investigation discovered that the Quantum ransomware operation was behind the attack, which initially demanded a $650,000 ransom from the agency.
The threat actors claimed to have stolen over 1TB of data and threatened to release it if IAD did not pay a ransom publicly.
Click to expand...

guest · Sep 3, 2022

LockBit ransomware gang gets aggressive with triple-extortion tactic
By Ionut Ilascu @Ionut_Ilascu - August 28, 2022

LockBit ransomware gang announced that it is improving defenses against distributed denial-of-service (DDoS) attacks and working to take the operation to triple extortion level.

The gang has recently suffered a DDoS attack, allegedly on behalf of digital security giant Entrust, that prevented access to data published on its corporate leaks site.
Data from Entrust was stolen by LockBit ransomware in an attack on June 18, according to a BleepingComputer source. The company confirmed the incident and that data had been stolen.
Click to expand...

Entrust did not pay the ransom and LockBit announced that it would publish all the stolen data on August 19. This did not happen, though, because the gang’s leak site was hit by a DDoS attack believed to be connected to Entrust.
LockBit getting into DDoS
Earlier this week, LockBitSupp, the public-facing figure of the LockBit ransomware operation, announced that the group is back in business with a larger infrastructure to give access to leaks unfazed by DDoS attacks.

LockBitSupp said that the ransomware operator is now looking to add DDoS as an extortion tactic on top of encrypting data and leaking it.

“I am looking for dudosers [DDoSers] in the team, most likely now we will attack targets and provide triple extortion, encryption + date leak + dudos, because I have felt the power of dudos and how it invigorates and makes life more interesting,” LockBitSupp wrote in a post on a hacker forum.
Click to expand...

Leaking Entrust data
The gang also promised to share over torrent 300GB of data stolen from Entrust so “the whole world will know your secrets.”
LockBit’s spokesperson said that they would share the Entrust data leak privately with anyone that contacts them before making it available over torrent.

It appears that LockBit has kept its promise and released this weekend a torrent called “entrust.com” with 343GB of files.
Click to expand...

They also announced an increase in the number of mirrors and duplicate servers, and a plan to increase the availability of stolen data by making it accessible over clearnet, too, via a bulletproof storage service.

LockBit ransomware operation has been active for almost three years, since September 2019. At the time of writing, LockBit’s data leak site is up and running.
The gang is listing more than 700 victims and Entrust is one of them, with data for the company leaked on August 27.
Click to expand...

guest · Sep 3, 2022

mood said: ↑

Cisco was hacked by the Yanluowang ransomware gang
August 10, 2022

Cisco Talos shares insights related to recent cyber attack on Cisco
Click to expand...

Evil Corp and Conti Linked to Cisco Data Breach, eSentire Suggests
By Alessandro Mascellino @a_mascellino - August 31, 2022

A new report by pure-play managed detection and response (MDR) service provider eSentire has connected the data breach affecting Cisco Talos systems in May with an Evil Corp-affiliate group.

More specifically, eSentire's Threat Response Unit (TRU) discovered that the IT infrastructure used to attack Cisco was also deployed in an attempted compromise of one of its clients in April 2022.

"TRU believes that a hacker who uses the alias, mx1r, is the cybercriminal behind the attack," eSentire wrote.
Click to expand...

For context, in an advisory published after the May attack, Cisco attributed their breach to a threat actor with ties to the Lapsus$ threat group, the Yanluowang ransomware operators, and a group that Mandiant calls UNC2447.

Fast forward to the present day, the MDR advisory clarified that while the tactics, techniques, and procedures (TTPs) of the attack against the workforce management corporation matched those of Evil Corp, the infrastructure used matched that of a Conti ransomware affiliate, which has been seen deploying both Hive and Yanluowang ransomware payloads.

"Looking at various technical details of the malicious infrastructure leveraged, TRU discovered a handful of additional instances of Cobalt Strike infrastructure," eSentire wrote.
Click to expand...

According to eSentire's report, HiveStrike also bears some similarities to the ShadowStrike infrastructure reported by TRU earlier this year with affiliations to Conti.

"It seems unlikely – but not impossible – that Conti would lend its infrastructure to Evil Corp," reads the advisory.
Click to expand...

guest · Sep 3, 2022

Ragnar Locker ransomware claims attack on Portugal's flag airline
By Sergiu Gatlan @serghei - August 31, 2022

The Ragnar Locker ransomware gang has claimed an attack on the flag carrier of Portugal, TAP Air Portugal, disclosed by the airline after its systems were hit on Thursday night.

The company said the attack was blocked and added that it found no evidence indicating the attackers gained access to customer information stored on impacted servers.

"TAP was the target of a cyber-attack, now blocked. Operational integrity is guaranteed," the airline operator revealed in a statement on Friday via its official Twitter account.
On Monday, the airline also published an alert saying that its website and app are unable because of the Thursday cyberattack.
Click to expand...

Even though TAP is yet to confirm if this was a ransomware attack, the Ragnar Locker ransomware gang posted a new entry on their data leak website today, claiming to be behind last week's cyberattack that hit TAP's network.

The ransomware group says it has "reasons" to believe that hundreds of Gigabytes of data might have been compromised in the incident and threatened to provide "irrefutable evidence" to disprove TAP's statement that its customers' data wasn't accessed in the incident.

"Several days ago Tap Air Portugal made a press-release where they claimed with confidence that they successfully repelled the cyber attack and no data was compromised (but we do have some reasons to believe that hundreds of Gigabytes might be compromised)," the gang says.
Ragnar Locker also shared a screenshot of a spreadsheet containing what looks like customer information stolen from TAP's servers, including names, dates of birth, emails, and addresses.
Click to expand...

guest · Sep 3, 2022

Migration policy org confirms cyberattack after extortion group touts theft
By Jonathan Greig @jgreigj - August 31, 2022

The International Centre for Migration Policy Development (ICMPD) confirmed on Wednesday it suffered a cyberattack that led to a data breach.

ICMPD operates in 90 countries conducting research, projects and activities centered around migration. It currently has 19 member states — most of which are European — and has observer status at the United Nations. It works with several UN and European agencies as well as states across Africa, Asia and South America.
Click to expand...

Bernhard Schragl, communication coordinator for ICMPD, did not say when the attack took place but told The Record that the attackers managed to gain “limited access” to individual servers that held data.

The attack on ICMPD was launched by the Karakurt extortion group, which boasted on Telegram of stealing financial documents, banking data and personal information.
On its leak site, the hacking group further explained that it stole 375 GB of data that included “correspondence on contracts, scans of contracts, project budgets, financial and insurance documents, invoices, passports, mailboxes of key members of the organization and much more.”
Click to expand...

Emsisoft threat analyst Brett Callow previously told The Record that the group has been active since the middle of 2021 and is believed to be a spin-off of the Conti ransomware group.

Several other security companies — including Infinitum IT and Advanced Intelligence — have released reports this year showing concrete ties between the infrastructure used by Conti and Karakurt.
Click to expand...

guest · Sep 3, 2022

Chile says gov’t agency struggling with ransomware attack
By Jonathan Greig @jgreigj - August 31, 2022

Chile’s cybersecurity incident response team said an unnamed government agency is dealing with a ransomware attack that targeted the organization’s Microsoft tools and VMware ESXi servers.

Chile’s CSIRT said the attack started last Thursday but did not respond to requests for comment about what group was behind the attack or what department or agency was attacked.
In a statement, the cybersecurity agency explained that during the attack, the extension “.crypt” was added to all files in the department’s system.
Click to expand...

Chile’s cybersecurity agency said the attacker was able to take complete control of the victim’s system and left a ransom note, offering a communication channel and ways to contact them.
The group threatened to sell the information on the dark web if the unnamed agency didn’t respond within three days.

No ransomware group has taken credit for the attack yet. Chile’s cybersecurity officials included some indicators of compromise and malware characteristics in their statement on the incident.
Click to expand...

Ransomware groups continue to show little fear in directly attacking governments, and over the past few months several Latin America and Caribbean nations have been hit. Chile’s own consumer protection agency announced last week that it was hit with ransomware in April. No group has come forward to take credit for the attack.
Click to expand...

guest · Sep 3, 2022

mood said: ↑

Quantum ransomware attack disrupts govt agency in Dominican Republic
By Lawrence Abrams @LawrenceAbrams - August 24, 2022
Click to expand...

mood said: ↑

Chile says gov’t agency struggling with ransomware attack
By Jonathan Greig @jgreigj - August 31, 2022
Click to expand...

Ransomware Attacks Target Government Agencies in Latin America
By Eduard Kovacs @EduardKovacs - September 1, 2022

Chile’s Ministry of Interior reported last week that a government agency had its systems and online services disrupted by a piece of ransomware that targeted Windows and VMware ESXi servers. The ransomware encrypted files on compromised systems and renamed them with the extension .crypt.

The targeted agency appears to be Sernac, the country’s National Consumer Service, which ensures the protection of consumer rights. The organization disclosed the incident on August 25.
Chilean authorities have made public some indicators of compromise (IoC) and based on the available information SecurityWeek believes the incident involved the relatively new RedAlert ransomware, which is also known as N13V.
Click to expand...

A government organization in the Dominican Republic was also hit by ransomware recently. The country’s national cybersecurity center said on August 24 that the Ministry of Agriculture’s Dominican Agrarian Institute (IAD) was targeted, but highlighted that the government does not plan on paying a ransom, to avoid encouraging threat actors to conduct these types of operations.

Bleeping Computer reported that the Quantum ransomware was involved in the attack. The cybercriminals claimed to have stolen more than 1 Tb of files and demanded a $650,000 ransom.
Currently there is no mention of IAD on Quantum’s data leak website.
Click to expand...

Earlier this month, ransomware also hit Argentina's Judiciary of Córdoba, forcing the organization to shut down systems and services. Bleeping Computer reported that a new piece of file-encrypting ransomware named ‘Play’ was involved in the incident.
Click to expand...

guest · Sep 3, 2022

mood said: ↑

Greek natural gas operator suffers ransomware-related data breach
August 22, 2022
Click to expand...

Ragnar Locker Ransomware Targets Energy Sector, Cybereason Suggests
By Alessandro Mascellino @a_mascellino - September 1, 2022

On Saturday, 20 August, Greece’s largest natural gas supplier DESFA said it was hit by a cyber-attack that impacted the availability of some of its systems.

The hacking group operating under the name of Ragnar Locker claimed responsibility for the ransomware attack, saying it had published more than 360 GB of data allegedly stolen from DESFA.
Click to expand...

Almost two weeks after the attack, security researchers from Cybereason have now released a Threat Analysis Report describing the details of the attack.

“Ragnar Locker is a ransomware that has been in use since at least December 2019 and is generally aimed at English-speaking users,” reads the document. “The Ragnar Locker ransomware has been on the FBI’s radar since the gang breached more than fifty organizations across ten critical infrastructure sectors.”
Click to expand...

The Cybereason advisory suggests that the first thing Ragnar Locker performs after infecting a system is to check the infected machine’s locale. If it finds a match with certain countries, including Russia, Ukraine and Belarus, the malware does not execute, and the process is terminated.

Otherwise, the ransomware starts extracting information about the infected machine and attempts to identify the existing file volumes on the host. After the identification phase, Ragnar Locker starts encrypting files and creates a ransom note, which is then displayed to the victim.
Click to expand...

Cybereason: THREAT ANALYSIS REPORT: Ragnar Locker Ransomware Targeting the Energy Sector

KEY FINDINGS

Breach of a Pipeline Company : DESFA is a strategic energy-related company that has been claimed by Ragnar Locker as their victim.

Security Evasion Capabilities : Ragnar Locker checks if specific products are installed, especially security products (antivirus), virtual-based software, backup solutions and IT remote management solutions.

Ransomware Actors Targeting the Energy Sector : This is the second important pipeline company that has been hit by ransomware, along with Colonial Pipeline. Furthermore, four energy companies have been hit recently by ransomware, including three in Europe.

Active for Three Years : Ragnar Locker is both a ransomware group and the name of the software in use. They have been running since 2019 and targeting critical industries. They use the double extortion scheme.

Excluding the Commonwealth of Independent States : Ragnar Locker avoids being executed from countries since the group is located in the Commonwealth of Independent States (CIS).

Click to expand...

guest · Sep 3, 2022

San Francisco 49ers: Blackbyte ransomware gang stole info of 20K people
By Sergiu Gatlan @serghei - September 2, 2022

NFL's San Francisco 49ers are mailing notification letters confirming a data breach affecting more than 20,000 individuals following a ransomware attack that hit its network earlier this year.

The San Francisco Bay Area professional American football team confirmed that personal information (including names and Social Security numbers) belonging to 20,930 impacted individuals was accessed and/or stolen in the attack between February 6 and February 11, 2022.

"The 49ers conducted a thorough review of these files to identify the individuals whose information was contained in the files, and additional research to locate and verify the addresses for these individuals," the team revealed in notification letters sent to affected individuals starting Thursday.
At the time, the 49ers confirmed the incident in a statement to BleepingComputer, saying it caused a temporary disruption to portions of their IT network.
Click to expand...

Attack claimed by the Blackbyte ransomware gang
The BlackByte gang claimed responsibility for the attack on February 12, right as the NFL was getting ready for Super Bowl 2022, by starting to leak files claimed were stolen from the 49ers' network.
The ransomware group also leaked an archive containing 292 MB worth of files the gang said were invoices stolen from 49ers' compromised servers.

Although it is unknown how much data was stolen during the February attack, BlackByte is known for selling gigabytes of data from some of its previous victims.
Click to expand...

The BlackByte ransomware operation was launched in July 2021 when it started targeting corporate entities worldwide.

"We notified law enforcement and are fully supporting their investigation," the 49ers added in the data breach notification letters.
Click to expand...

guest · Sep 6, 2022

Ransomware attack on leading Georgia art college leads to data leak
By Jonathan Greig @jgreigj - September 6, 2022

Savannah College of Art and Design (SCAD) — an acclaimed art school in the U.S. serving more than 15,000 students — suffered a ransomware attack that leaked the sensitive information of hundreds of people.

A spokesperson for the school told The Record that it recently discovered a hacker had gained access to SCAD’s information network systems.
Click to expand...

The school hired third party cybersecurity experts who isolated the incident and launched an investigation. Law enforcement has been notified and is working with cybersecurity experts on the investigation, they said.

“Due to the university’s early detection and rapid response, the incident had no operational impact to the university,” a spokesperson said. “After a forensic investigation, SCAD has reason to believe that a limited number of files containing personal information of certain current and former students and employees were accessed by the unauthorized actor responsible for the incident.”
Click to expand...

The group claims to have stolen a database of phone numbers, email addresses and more. Experts at DataBreaches.net examined the data leaked by AvosLocker and found that the group managed to take at least 69,000 files that contained student information, personnel files and business data.

This included passports, bank statements, disciplinary files and other documents that had Social Security numbers, according to DataBreaches.net. The ransomware group told the website that SCAD allegedly negotiated with them for an undisclosed ransom but did not end up paying.
Click to expand...

guest · Sep 9, 2022

LockBit, ALPHV, and Other Ransomware Gang Leak Sites Hit by DDoS Attacks
By Nathan Eddy - September 9, 2022

The ransomware-as-a-service (RaaS) groups LockBit and ALPHV (aka BlackCat), among others, have been the focus of distributed denial-of-service (DDoS) attacks targeting their data leak sites, causing downtime and outages.

The attacks have been monitored by Cisco Talos since Aug. 20 and include a wide range of other RaaS groups, including Quantum, LV, Hive, Everest, BianLian, Yanluowang, Snatch, and Lorenz.
Click to expand...

Forum posts by the LockBit gang's technical support arm, "LockBitSupp," indicate that the attacks have had a significant impact on the group's activities, with nearly 1,000 servers targeting the leak site with close to 400 requests per second, researchers said.

"Many of the aforementioned groups are still affected by connectivity issues and continue to face a variety of intermittent outages to their data leak sites, including frequent disconnects and unreachable hosts, suggesting that this is part of a sustained effort to thwart updates to those sites," a Talos blog post explained this week.
Click to expand...

The groups have responded in different ways, with some sites simply redirecting web traffic elsewhere, as in the case of the Quantum group, while others have beefed up DDoS protections.

"Given that this activity is continuing to interrupt and hinder the ability for these affiliates and operators to post new victim information publicly, we will likely continue to see various groups respond differently, depending on the resources available to them," the blog post authors noted.
Click to expand...

Cisco Talos: Multiple ransomware data leak sites experience DDoS attacks, facing intermittent outages and connectivity issues

By Azim Khodjibaev @AShukuhi, Colin Grady @ColinGrady, Paul Eubanks @paul_eubanks - September 7, 2022

Since Aug. 20, 2022, Cisco Talos has been monitoring suspected distributed denial-of-service (DDoS) attacks resulting in intermittent downtime and outages affecting several ransomware-as-a-service (RaaS) data leak sites.

While the source and origin of this activity remain unknown, this appears to be a concentrated effort against RaaS leak sites to disrupt their efforts to announce and post new victim information.

Actors' responses have varied, with LockBit and ALPHV implementing new measures to counteract DDoS attacks against their sites while other groups like Quantum have simply resorted to redirecting web traffic elsewhere. LockBit also appears to have co-opted this technique by advertising that they are now adding DDoS as an extortion tactic in addition to encrypting and leaking data.

Click to expand...

guest · Nov 8, 2022

LockBit ransomware claims attack on Continental automotive giant
By Sergiu Gatlan @serghei - November 3, 2022

The LockBit ransomware gang has claimed responsibility for a cyberattack against the German multinational automotive group Continental.

LockBit also allegedly stole some data from Continental's systems, and they are threatening to publish it on their data leak site if the company doesn't give in to their demands within the next 22 hours.
The gang has yet to make any details available regarding what data it exfiltrated from Continental's network or when the breach occurred.
Click to expand...

Ransomware gangs commonly publish data on their leak sites as a tactic to scare their victims into negotiating a deal or into returning to the negotiation table.
Breached in an August cyberattack
Continental's VP of Communications & Marketing, Kathryn Blackwell, didn't confirm LockBit's claims and would not share any details regarding the attack when BleepingComputer reached out but, instead, linked to a press release from August 24 regarding a cyberattack that led to a breach of Continental's systems.

"Please see the statement we have issued on this topic. Unfortunately, I cannot provide you with any further details," Blackwell told BleepingComputer.
According to the press release, the company detected a security breach in early August after attackers infiltrated parts of its IT systems.
Click to expand...

guest · Nov 9, 2022

LockBit 3.0 gang claims to have stolen data from Kearney & Company
By Pierluigi Paganini - November 6, 2022

The ransomware group LockBit claimed to have stolen data from consulting and IT services provider Kearney & Company.
Click to expand...

Kearney is the premier CPA firm that services across the financial management spectrum to government entities. The company provides audit, consulting and IT services to the United States government. It has helped the Federal Government improve its financial operations’ overall effectiveness and efficiency.

Kearney & Company was added to the list of victims of the Lockbit 3.0 group on November 05, the gang is threatening to publish stolen data by November 26, 2022, if the company will not pay the ransom. At this time, the ransomware gang has published a sample of the stolen data that includes financial documents, contracts, audit reports, billing documents and more.
Click to expand...

The ransomware gang is demanding the payment of $2M to destroy the stolen data and $10K to extend the timer for 24H.
Click to expand...

guest · Nov 10, 2022

Conti Affiliates Black Basta, BlackByte Continue to Attack Critical Infrastructure
By Alessandro Mascellino @a_mascellino - November 9, 2022

Between the end of February and mid-July 2022, 81 victim organizations were listed on the BlackByte and Black Basta data leak sites.

The new data comes from the threat response unit (TRU) at eSentire, which shared the findings with Infosecurity ahead of publication.

“What stands out is that the US companies that were attacked by these two ransomware gangs during this time frame, for the most part, are not part of critical infrastructure sectors,” the report reads.
“In typical ransomware branding fashion, Conti did not shut down; rather, they moved their operation into other ransomware brands, including Black Basta and BlackByte,” Keplinger told Infosecurity.
Click to expand...

According to the eSentire report, these included the Black Basta attacks on the wind turbine services company Deutsche Windtechnik in April and the Switzerland-based national food company The Groupe Laiteries Réunies in May. Also in May was an attack against Jacob Becker, a sizeable German waste disposal company, and in June, there were attacks against Danish railroad company Lokaltog A/S and Italy-based chemical manufacturer RadiciGroup.

As for the BlackByte group, eSentire mentions attacks against Switzerland-based international transportation and logistics company M+R Spedag Group in April. It also describes hacking attempts against a major Italian wholesale food distributor, a pharmaceutical distributor out of Greece and a healthcare products manufacturer out of Columbia, among others.
Click to expand...

eSentire: Notorious Russian Gang and Affiliates Increase Ransomware Attacks Against Europe

For several years, eSentire’s Threat Response Unit (TRU) has been keeping close tabs on the Conti group’s illicit activities. Despite Conti shutting down operations as a formal entity, two Conti affiliate groups, BlackByte and Black Basta, emerged on the ransomware scene between July 2021 and April 2022.

Between the end of February and mid-July 2022, TRU has tracked 81 victim organisations listed on the BlackByte and Black Basta data leak sites; 41% of their victims are based in Europe and many are part of critical infrastructure sectors including energy, government, transportation, pharmaceuticals, facilities, food, and education.
Click to expand...

As evidenced by the cyberattacks and the damage caused by the Black Basta and BlackByte affiliates, the Conti threat is alive and well, and is as destructive as it has always been.
Click to expand...

guest · Nov 10, 2022

mood said: ↑

LockBit ransomware claims attack on Continental automotive giant
By Sergiu Gatlan @serghei - November 3, 2022
Click to expand...

Ransomware Gang Offers to Sell Files Stolen From Continental for $50 Million
By Eduard Kovacs @EduardKovacs - November 10, 2022

A notorious ransomware group is offering to sell files allegedly stolen from German car parts giant Continental for $50 million.
Click to expand...

Continental reported in August that it had been targeted in a cyberattack that resulted in hackers accessing some of its systems. The company said at the time that the attack had been “averted” and that business activities were not affected.

The LockBit ransomware group recently revealed on its leak website that it was behind the attack on Continental and threatened to make public information stolen from the company.
Click to expand...

Shortly after announcing the Continental hack, the cybercriminals published what appeared to be messages exchanged between them and the company’s representatives. The messages suggested that negotiations had failed.
The hackers have now published four screenshots to demonstrate that they do possess data from Continental systems. There is also a timer that suggests more data will be leaked on November 10.

In addition, the page dedicated to the automotive company now displays three buttons. One of them can be used to extend with 24 hours the time until files are published, which costs $100. Two other buttons can be used to ‘destroy all information’ or ‘download data at any moment’ — both of these options have a $50 million price tag.
Click to expand...

guest · Nov 10, 2022

Silverstone Formula One circuit posted on ransomware leak site
By Vilius Petkauskas @MrVilius - November 10, 2022

Royal ransomware posted the legendary Silverstone Circuit on its victim list on the dark web.
Click to expand...

Threat actors posted Silverstone on Royal ransomware cartel’s leak site on November 8. The post doesn’t specify what type of information threat actors might have taken.

Meanwhile, Silverstone's representatives told Cybernews the company is investigating why it's name appeared on a ransomware gang's leak site.

"We are aware of this posting and are investigating this matter,” Silverstone's press office told Cybernews.
Silverstone Circuit is a well-known motor racing circuit in the UK, hosting the British Grand Prix leg of the Formula One race since 1948.
Click to expand...

Royal is a relatively new ransomware family, first noticed in early 2022. The group employs a double extortion tactic many other criminal groups use. However, researchers believe Royal operates without affiliates and is run by a private group of members.

The group also presents victims with hefty ransom demands ranging from $250k to $2 million.
Click to expand...

guest · Nov 11, 2022

Canadian food retail giant Sobeys hit by Black Basta ransomware
By Sergiu Gatlan @serghei - November 11, 2022

Grocery stores and pharmacies belonging to Canadian food retail giant Sobeys have been experiencing IT systems issues since last weekend.

Sobeys is one of two national grocery retailers in Canada, with 134,000 employees servicing a network of 1,500 stores in all ten provinces under multiple retail banners, including Sobeys, Safeway, IGA, Foodland, FreshCo, Thrifty Foods, and Lawtons Drugs.
Click to expand...

In a press release published Monday, Sobeys' parent company Empire revealed that while its grocery stores were still open, some services were impacted by this company-wide IT issue.

"The Company's grocery stores remain open to serve customers and are not experiencing significant disruptions at this time. However, some in-store services are functioning intermittently or with a delay," the retailer revealed.
In a separate statement published on Sobeys' official website with "important information" regarding the retailer's store services, Sobeys added that all stores remained open and were "not experiencing significant disruptions."
Click to expand...

IT issues caused by a Black Basta ransomware attack
While the company is yet to disclose any information linking this ongoing outage to a cyberattack, local media reported that Canadian provincial privacy watchdogs from Quebec and Alberta have confirmed receiving "confidentiality incident" notifications from the retailer.

Furthermore, based on ransom notes and negotiation chats BleepingComputer has seen, the attackers deployed Black Basta ransomware payloads to encrypt systems on Sobeys' network.
Click to expand...

Although the gang's ransom demands likely differ in size between victims, BleepingComputer knows of at least one incident where the victim received a demand of more than $2 million for a decryptor to avoid having stolen data leaked online.
Click to expand...

guest · Nov 13, 2022

Lockbit gang leaked data stolen from global high-tech giant Thales
By Pierluigi Paganini - November 13, 2022

Thales is a global high-tech leader with more than 81,000 employees worldwide. The Group invests in digital and deep tech innovations – big data, artificial intelligence, connectivity, cybersecurity and quantum – to build a future of trust, essential to the development of our societies, by placing people at the heart of decision-making.

Early this month, the French defence and technology group confirmed to be aware that the ransomware group LockBit 3.0 claimed to have stolen some of its data.
Click to expand...

Thales was added to the list of victims of the Lockbit 3.0 group on October 31, the gang threatened to publish stolen data by November 7, 2022, if the company would have not paid the ransom by the deadline.
The deadline was reached and the ransomware gang maintained its promise and carried out its threats.

On Friday, the group started publishing confidential data stolen from the company. Thales downplayed the incident and explained that the security breach will have no impact on its activities.
Click to expand...

This is the second time this year that the Thales was the victim of a cyber attack orchestrated by the Lockbit gang.

“These 1,320 files were no longer available for download on Tuesday morning. ” reported the French newspaper Le Parisien. “Contacted by Le Parisien, the Thales group acknowledged the exfiltration of data and specified that “most of the stolen files which appear to have been copied from a code repository server (“code repository”), hosting data with a low level of sensitivity and which is external to the group’s main information systems.””
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches