Content by Mathew J. Schwartz

Conti Ransomware Attacks Surging, US Government Warns

Mathew J. Schwartz  •  September 23, 2021

The pace of Conti ransomware attacks has been increasing, with more than 400 organizations globally having fallen victim, warns a joint cybersecurity advisory from the U.S. Cybersecurity and Infrastructure Security Agency, FBI and National Security Agency, which details essential defenses.

ISMG Editors’ Panel: Cyber Insurers and Ransomware Response

Mathew J. Schwartz  •  September 22, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including the role of cyber insurers in supporting ransomware victims' incident response, and how to build a successful bug bounty program.

Good News: REvil Ransomware Victims Get Free Decryptor

Mathew J. Schwartz  •  September 17, 2021

Score one for the good guys in the fight against ransomware: Anyone who fell victim to REvil, aka Sodinokibi, crypto-locking malware before July 13 can now decrypt their files for free, thanks to a decryptor released by security firm Bitdefender.

Is White House Crackdown on Ransomware Having Any Effect?

Mathew J. Schwartz  •  September 17, 2021

The latest edition of the ISMG Security Report features an analysis of the state of the Biden administration's efforts to disrupt ransomware attackers, as well as how a newly patched Apple iMessage flaw was being targeted by Pegasus spyware to effect zero-click exploits.

Russia Has Taken No Action to Combat Ransomware, FBI Says

Mathew J. Schwartz  •  September 15, 2021

Senior U.S. officials say that there have been no signs that Moscow has begun to crack down on ransomware-wielding criminals operating from inside Russia's borders. President Biden has called on Russia to act responsibly, and U.S. intelligence has been sharing information on top suspects.

Top Initial Attack Vectors: Passwords, Bugs, Trickery

Mathew J. Schwartz  •  September 14, 2021

The top three tactics attackers have been using to break into corporate and government networks are brute-forcing passwords, exploiting unpatched vulnerabilities, and social engineering via malicious emails, says security firm Kaspersky in a roundup of its 2020 incident response investigations.

Bad News: Innovative REvil Ransomware Operation Is Back

Mathew J. Schwartz  •  September 13, 2021

Security experts say the notorious REvil - aka Sodinokibi - ransomware-as-a-service operation, which went dark in July, appears to be back in business. The group's data leak site and payment portal are back online, and one expert says the group appears to have begun amassing new victims.

Ransomware Stopper: Mandatory Ransom Payment Disclosure

Mathew J. Schwartz  •  September 10, 2021

"Silence is gold." So says ransomware operator Ragnar Locker, as it attempts to compel victims to pay its ransom demand without ever telling anyone - especially not police. But some ransomware-battling experts have been advocating the opposite, including mandatory reporting of all ransom payments.

Groove Promises Maximum Profits for Ransomware Affiliates

Mathew J. Schwartz  •  September 9, 2021

Apparent Babuk ransomware operation spinoff Groove, self-described as being an "aggressive financially motivated criminal organization," has launched as part of the new RAMP cybercrime forum, and is promising affiliates a bigger share of profits than traditional ransomware-as-a-service operations.

Ragnar Locker: 'Talk to Cops or Feds and We Leak Your Data'

Mathew J. Schwartz  •  September 7, 2021

The Ragnar Locker ransomware operation has been threatening to dump victims' stolen data if they contact police, private investigators or professional negotiators before paying a ransom. But as one expert notes: "Perhaps the criminals watched too many TV shows, because this isn’t how the real world works."

Criminals' Wish List: Who's Their Ideal Ransomware Victim?

Mathew J. Schwartz  •  September 6, 2021

The most sought-after type of victim for ransomware-wielding attackers is a large, U.S.-based business with at least $100 million in revenue, not operating in the healthcare or education sector, with remote access available via remote desktop protocol or VPN credentials, threat intelligence firm Kela reports.

Conti Ransomware Threat Rising as Group Gains Affiliates

Mathew J. Schwartz  •  September 3, 2021

As the United States heads into a holiday weekend, experts are warning that ransomware-wielding attackers are sure to unleash crypto-locking chaos in the coming days, with Conti ransomware attacks in particular having been rising sharply in recent weeks.

Attackers Keep Refining Business Email Compromise Schemes

Mathew J. Schwartz  •  September 1, 2021

Business email compromise attacks, which balance low-tech tactics with the potential for big profits, remain popular. Attackers continue to refine their tactics, including subverting legitimate redirect services as well as recruiting English-speaking business partners and cryptocurrency tumbler operators.

Wait, Watch, Disrupt: How Police Keep Targeting Cybercrime

Mathew J. Schwartz  •  August 31, 2021

Because a relatively small number of individuals provide the vast majority of services and infrastructure that power cybercrime, they remain top targets for arrest - or at least disruption - by law enforcement authorities, says cybercrime expert Alan Woodward. But of course, geopolitics sometimes gets in the way.

7 Emerging Ransomware Groups Practicing Double Extortion

Mathew J. Schwartz  •  August 26, 2021

After a string of high-profile hits, many of the largest and most notorious ransomware operations recently disappeared. But the pace of ransomware attacks hasn't diminished because of a steady influx of new operations, existing operations getting more sophisticated and old players rebranding.