Monthly Threat Highlights Report

August 2022

Top malware strains 2021

• Mailchimp and Twilio incidents highlight the supply chain issue
• State-backed actors target Confluence vulnerability
• Microsoft disrupt Callisto Group

Ransomware: Trends and notable reports

• ENISA’s ransomware threat landscape
• A history lesson on Ransomware
• A look at Initial Access Brokers
• Newcomers: SolidBit

Other notable highlights in brief
Research highlights: WithSecure™ ransomware threat update

July 2022

- Trickbot group attack Ukraine
- Brute Ratel being abused by threat actors
- Black Basta on the rise
- Ransomware: Trends and notable reports

• BlackCat under the spotlight
• Vice Society
• A closer look at LockBit 3.0
• Hive joins BlackCat in using Rust
• CISA produce alert on MedusaLocker
• HavanaCrypt, a new group with novel tactics
• Q2 statistics from Digital Shadows

• - Other notable highlights in brief

  - Threat data highlights
  - Research highlights: Ducktail: An infostealer malware targeting Facebook business accounts

June 2022

- Follina, an exploited vulnerability in MSDT
- Emotet back at full power
- State-backed actors target Confluence vulnerability
- Law enforcement takes down Flubot
- Ransomware: Trends and notable reports

• A look at the ransomware ecosystem
• LockBit is updated to 3.0
• An advisory on Karakurt
• “Ransomware” targeting Elasticsearch
• The costs of ransomware to businesses

• - Other notable highlights in brief
  - Research highlights: WithSecure™ ransomware threat update

   

May 2022

- Advisory on initial access techniques
- Emotet back at full power
- BPFDoor, an insidious backdoor
- Ransomware: Trends and notable reports:

• Is this the end of Conti?
• Iran is carrying out ransomware attacks
• Operator of Thanos builder charged
• The return of REvil?

• - Other notable highlights in brief

   

April 2022

- CNI targeted with ICS malware
- FA Fatigue: A new attack technique
- The disruption of ZLoader
- A breakdown of ContiLeaks
- RANSOMWARE: Trends and Notable Reports

• A look at Blackcat/ALPHV
• Russia in the crosshairs
• Quantum: a 4-hour attack
• LockBit strike Rio de Janeiro finance department
• BlackByte breakdown
• Nokoyawa, a Nempty strain

• - Other Notable Highlights in Brief

   

March 2022

- Okta LAPSUS$ Compromise
- Heightened Awareness of Russian Threat Activity
- Chinese backed actor APT41 attacks US government
- Initial access broker for Conti uses complex social engineering
- RANSOMWARE: Trends and Notable Reports

• RURansom targets Russia
• Advisory on AvosLocker
• HermeticRansom can be decrypted
• Sophos collates their ransomware research
• An analysis of LockBit 2.0
• Estonian imprisoned for connection with ransomware and cybercrime

• - Other Notable Highlights in Brief

   

February 2022

- RUSSIA-UKRAINE CONFLICT: Related cyber activity
- SANDWORM: Using new malware Cyclops Blink
- KARAKURT: A threat actor focused on extortion
- DAXIN: A Chinese-linked espionage tool
- RANSOMWARE: Trends and Notable Reports

• Recovery of data encrypted by Hive ransomware
• Joint advisory on ransomware
• CONTI Leaks

• - Other Notable Highlights in Brief

   

January 2022

- UKRAINE: Defacements and WhisperGate Wiper
- CISA: Russian Nation State Threats
- Log4j: A Pervasive Library Vulnerability
- SYSJOKER: New Backdoor Targets Windows, Mac and Linux
- EARTHLUSCA: Financially Motivated Chinese Threat Actor
- RANSOMWARE: Trends and Notable Reports

• REvil Associates Arrested
• Europol shutdown VPN Labservers
• Other Ransomware Group Insights

• - Other Notable Highlights in Brief