Create accountLogin

Recent searches

No recent searches

Search options

Not available on dice.camp.
dice.camp is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon server for RPG folks to hang out and talk. Not owned by a billionaire.

Administered by:

Server stats:

1.8K
active users

dice.camp: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#ransomhub

0 posts0 participants0 posts today
Public
ESET Research

#ESETresearch discovered previously unknown links between the #RansomHub, #Medusa, #BianLian, and #Play ransomware gangs, and leveraged #EDRKillShifter to learn more about RansomHub’s affiliates. @SCrow357 welivesecurity.com/en/eset-res
RansomHub emerged in February 2024 and in just three months reached the top of the ransomware ladder, recruiting affiliates from disrupted #LockBit and #BlackCat. Since then, it dominated the ransomware world, showing similar growth as LockBit once did.
Previously linked to North Korea-aligned group #Andariel, Play strictly denies operating as #RaaS. We found its members utilized RansomHub’s EDR killer EDRKillShifter, multiple times during their intrusions, meaning some members likely became RansomHub affiliates.
BianLian focuses on extortion-only attacks and does not publicly recruit new affiliates. Its access to EDRKillShifter suggests a similar approach as Play – having trusted members, who are not limited to working only with them.
Medusa, same as RansomHub, is a typical RaaS gang, actively recruiting new affiliates. Since it is common knowledge that affiliates of such RaaS groups often work for multiple operators, this connection is to be expected.
Our blogpost also emphasizes the growing threat of EDR killers. We observed an increase in the number of such tools, while the set of abused drivers remains quite small. Gangs such as RansomHub and #Embargo offer their killers as part of the affiliate program.
IoCs available on our GitHub: github.com/eset/malware-ioc/tr

Public
LavX News

RansomHub Ransomware Unleashes Betruger: A Multi-Function Backdoor Threatening Cybersecurity

The emergence of the Betruger backdoor marks a significant evolution in ransomware tactics, allowing attackers to minimize the number of tools used during an attack. This custom malware, linked to the...

news.lavx.hu/article/ransomhub

RansomHub Ransomware Unleashes Betruger: A Multi-Function Backdoor Threatening Cybersecurity
#news#tech#Cybersecurity
Public
Manuel 'HonkHase' Atug

#Grohe AG von #Ransomware-Attacke betroffen

"Die Grohe AG zählt zu den bekanntesten deutschen Herstellern von Armaturen und Sanitärprodukten. Die berüchtigte Ransomware-Bande #Ransomhub listet das Unternehmen nun als Opfer auf ihrer Darknet-Seite. Die Hacker behaupten, erfolgreich eingedrungen zu sein und 100 Gigabyte Daten erbeutet zu haben."
csoonline.com/article/3808703/

CSO Online · Grohe AG von Ransomware-Attacke betroffenBy Julia Mutzbauer
ExploreLive feeds
About