Trimark Security’s Post

‘However, the existing metrics do not capture the effectiveness of its disruptive activities against malicious actors because they did not account for DOJ’s shift from arrests and indictments … towards DOJ actions to disrupt both ransomware actors and the broader cybercriminal ecosystem. ‘United States Attorney’s Offices differed in their awareness and implementation of the DOJ’s deconfliction policy for cyber threats … ‘However, in 2022 Congress established a new, multi-agency Joint Ransomware Task Force to coordinate whole-of-government responses to ransomware threats. We found that the creation of the Joint Ransomware Task Force impacted the role of the [FBI’s] Criminal Mission Center, leaving its ransomware role not well defined’. METRICS + CHAINS OF COMMAND https://lnkd.in/gnMxQ3Ht

Don't let ransomware turn into your worst nightmare, with all your computers and servers compromised. Contact Compass Advisory Group for expert guidance and solutions to protect your digital assets effectively. . . 🌐https://lnkd.in/eAF6X-q3 . . #CyberSecurity #Creditunions #RansomwareProtection #CreditUnionSecurity #Associations #AssociationSecurity #CompassAdvisoryGroup

The United States Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Defense Cyber Crime Center (DC3) have issued a joint Cybersecurity Advisory warning of persistent cyber threats from Iran-based actors. The advisory highlights the ongoing exploitation of U.S. and foreign organizations across multiple sectors by a group associated with the government of Iran (GOI). The advisory reveals that these actors are engaged in state-sponsored espionage and financially motivated ransomware attacks. According to the FBI's assessment, "a significant percentage of these threat actors' operations against US organizations are intended to obtain and develop network access to then collaborate with ransomware affiliate actors to deploy ransomware." Thanks Drew Todd for highlighting this problem. https://lnkd.in/ga5GeYtb

In the past two years, Black Basta has compromised more than 500 organizations all over the world, cementing its position as one of the most prolific ransomware threats worldwide. Among the victims are organizations in 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector. Read more from TechRadar: https://lnkd.in/eH3NN6Wf #ransomware #BlackBasta #cyberthreat #cybercriminals #cyberattack #dataexfiltration #ADX #datatheft #criticalinfrastructure #cybersecurity

The #FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have released a joint #CybersecurityAdvisory to disseminate TTPs and IOCs associated with the Phobos ransomware variants. Since May 2019, Phobos ransomware has targeted municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to ransom millions of dollars. The FBI, CISA, and the MS-ISAC encourage organizations to implement the mitigations outlined in this advisory to reduce the likelihood and impact of Phobos ransomware and other ransomware incidents: https://lnkd.in/euSsGSHE This joint CSA is part of an ongoing #StopRansomware effort to give network defenders the information they need to protect against the most prolific ransomware and to reduce the likelihood and impact of ransomware incidents. Visit stopransomware.gov to learn more.

It is more advantageous to be proactive rather than reactive when it comes to defending against Phobos ransomware attacks.

🚨 Phobos ransomware targets US critical infrastructure 🚨 Threat actors using the Phobos ransomware have launched a series of attacks targeting the U.S. government and critical infrastructure entities. They employed phishing, RDP brute-forcing, and privilege escalation techniques to deploy their ransomware. 👉 Phobos is a ransomware as a service (RaaS) model that is a good case study for the shifting trends we are seeing in ransomware. Ransomware is moving to a service-based model that threat actors use; there is no guarantee of data recovery; gangs use double extortion to increase profit; the same victims are being targeted multiple times; and no victim is off limits. #cybersecurity #news #threatintelligence #ransomware #trends

For those not aware, the #phobos #ransomware family is primarily targeting #remotedesktop #connections (#RDP). There is a lot of information on this #malware but I think the #Cisco deep dive is one of the better reads: https://lnkd.in/gUT23-VQ

The FBI, CISA, and MS-ISAC recommend implementing application controls, including allowlisting remote access programs, to enhance cybersecurity. 👉 PC Matic Application Allowlisting prevents cybercriminals from running malware or ransomware on your network and endpoints to disrupt operations, steal sensitive data, encrypt files, or hold critical digital assets for ransom. #applicationallowlisting #CISA #FBI #SMB #cybersecurity #ransom

Spread the word. #StopRansomware