Cybersecurity

Since last month’s re-emergence of Emotet – Everybody’s Email Enemy #1 – we’ve observed its rekindling with Trickbot to spread and propensity for proliferating ransomware attacks. However, the last 10 months since its global takedown effort appear to have been time well-spent for the malware as it has come up with some new tricks.

The cybersecurity firm G DATA just released a vaccine for the STOP ransomware variant. This decryption tool is notable given that STOP ransomware is one of the most active ransomware variants in the wild that no one talks about. In fact, of the thousands of ID Ransomware submissions received every day, during active ransomware periods, 60 to 70 percent are STOP ransomware submissions. The vaccine does not prevent an initial infection of the ransomware.

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS vulnerability advisories, as well as alerts, updates, and bulletins:

ICS Vulnerability Advisories:

New research from Trend Micro sheds light on the potential factors behind the recent surge in ransomware attacks, namely, cyber-criminal marketplaces offering initial access to threat actors. Over the past two years, demand for initial access has grown so much that many dark web markets now have a dedicated “Access-as-a-Service” section. The researchers divided access brokers into three categories: opportunistic sellers, dedicated brokers whose services are often used by smaller ransomware groups, and online shops that provide RDP and VPN credentials.