Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

cyjax

From Initial Access to Ransomware Attack: An Analysis of Timelines from IAB Listings on Cybercriminal Forums to Extortion Attacks

Feb 28, 2025 By Adam Price In CYJAX
Cyjax monitors and analyses the initial access broker (IAB) market on the most prominent cybercriminal forums. As noted in Cyjax’s 2024 IAB market in review, it is almost certain that extortion groups, APTs, data brokers, and other threat groups use IABs to gain initial access to targeted networks. Though at first glance it is not immediately obvious how important the IAB market is to the threat landscape, Cyjax has conducted a deep analysis of public IAB listings and extortion group DLSs.
Read Post
cyjax

The BlackBasta Ransomware Leaks: What You Need to Know

Feb 28, 2025 By Cymon In CYJAX
On 11 February 2025, a Telegram user called ExploitWhispers shared a ZIP file to a Russian-language Telegram channel. The user claimed that this file contained the internal Matrix chat logs of the BlackBasta ransomware group and was captured between 18 September 2023 and 28 September 2024. The user also shared information about some of the BlackBasta members, including one of the operation’s admins, the group’s administrator, and leader Oleg Nefedov.
Read Post
splunk

Infostealer Campaign against ISPs

Feb 28, 2025 By Splunk Threat Research Team In Splunk
The Splunk Threat Research Team has identified a campaign targeting ISP infrastructure providers on the West Coast of the United States and the country of China. This mass exploitation campaign originates from Eastern Europe and uses simple tools that abuse victim’s computer processing power to install cryptomining payloads and binaries with diverse functions such as.
Read Post
Rubrik

Beyond AWS Native Backup: A Simpler Path to Data Protection

Feb 27, 2025 By Mike Preston In Rubrik
We are often asked how Rubrik Security Cloud differs from AWS Backup. It's a valid question because, at first glance, the two solutions seem similar. Both have cloud-first, API-driven architectures. Both are built specifically to ensure reliable backup and recovery for data stored across AWS. Both support a wide range of the most popular AWS workloads including EC2, EBS, S3, RDS and EKS.
Read Post
Rubrik

Building High Availability into a Large Cloud SQL Fleet, Part 2: Optimizations and Design Choices

Feb 27, 2025 By Manjunath Chinni In Rubrik
At Rubrik, we rely on a multi-tenant architecture to store customer metadata in a large fleet of Cloud SQL database instances. With numerous production deployments globally, each supporting multiple customer accounts, maintaining high availability, performance, and robustness across this infrastructure is critical. Managing a large fleet of Cloud SQL instances and ensuring they remain resilient and performant has been a journey filled with valuable lessons.
Read Post

Sue Bergamo - Confidentiality, Integrity, and Availability - CIA Triad

Feb 27, 2025 By Rubrik In Rubrik
“This isn't a job for the faint of heart. If people can't understand the triad that CISOs abide by—confidentiality, integrity, and availability—then it’s our job to make them understand.” Sue Bergamo Exciting news! In our latest episode of Data Security Decoded, we had the pleasure of hosting Sue Bergamo, CIO and CISO at BTE Partners.
View Video
fidelis security

NDR for Ransomware Attack: How Tools Defend Against It

Feb 27, 2025 By Fidelis Security In Fidelis Security
“It takes 18 days on average for organizations to recover from a ransomware attack” – IBM Cost of a Data Breach Report 2024. The clock starts ticking as soon as ransomware hits your network. Attackers no longer rely solely on opportunistic phishing; they now attack weak network defenses, move laterally across systems, and encrypt important data before demanding a ransom. Traditional security solutions sometimes notice breaches too late to adequately detect threats.
Read Post

The Hidden Cost of Hospital Cyber Attacks: What Happens to Patients? #Healthcare #DataSecurity

Feb 26, 2025 By Rubrik In Rubrik
What happens to patients when their local hospital has a ransomware attack? How do you even find that? You collect data on every cyberattack on a healthcare provider. Next, you look at data from Medicare and then overlay those two data sets. Simple. Listen to the latest episode of the @Data Security Decoded podcast, where @Steve Stone is joined by @Hannah Neprash, PhD, Assistant Professor at the University of Minnesota School of Public Health.
View Video
WatchGuard

WatchGuard Labs Detects 300% Surge in Endpoint Malware in Q3 2024

Feb 26, 2025 By Marc Laliberte In WatchGuard
While malware growth is something we have been experiencing over the past few years, the increase observed by WatchGuard's threat lab team in Q3 2024 was the highest to date. Q3 saw astronomical growth in total endpoint malware threats, reaching 300.48% with 420,304 threats. The previous high was recorded in Q1 2024, when there was an 81.77% rise, almost double the previous quarter. However, Q3 almost quadrupled the figure for Q2 2024 when 104,951 threats were detected.
Read Post
manageengine

Scattered Spider: Weaving an ever expanding web of cybercrimes

Feb 25, 2025 By Endpoint Central In ManageEngine
Imagine you are the owner of a bustling casino casually observing the vibrant scene: The clatter of slot machines, wagers are being placed, the cheerful chatter of gamblers, and waiters are serving cocktails. Everything appears normal until, without warning, the machines fall silent. However, it doesn’t stop there. Elevators grind to a halt, parking gates freeze shut, and guests find themselves locked out of their rooms as digital door keys fail to function.
Read Post
cyjax

Is that Ra? Nope, it is RaaS - DLS emerges for New Extortion Group Anubis

Feb 25, 2025 By Adam Price In CYJAX
In 2024, Cyjax observed the emergence of 72 extortion and ransomware group data-leak sites (DLSs). As of late February 2025, Cyjax has identified DLSs for six new groups in 2025, as noted in recent blogs on extortion groups Kraken, Morpheus, GD LockerSec, Babuk2, and Linkc. The latest DLS which Cyjax has identified is named Anubis. This Ransomware-as-a-Service (RaaS) group appears to be sophisticated and professional, providing services including affiliates, data ransoms, and access monetisation.
Read Post

Faster Remediation with Data-Centric Security Insights

Feb 25, 2025 By Rubrik In Rubrik
In this episode of Into the Breach, James Purvis and Mike Schmidt discuss how adopting a data-centric security approach can lead to faster remediation and better alert prioritization. With SOC teams overwhelmed by millions of alerts, they explore how DSPM (Data Security Posture Management) provides visibility, reduces noise, and focuses on protecting sensitive data. Learn how DSPM can help streamline security operations and safeguard your business-critical assets.
View Video

Ransomware in 2025: The Cyber Threat That Can Shut Down Your Business!

Feb 25, 2025 By Fidelis Security In Fidelis Security
Ransomware isn’t just a cyber threat—it’s a crisis. By 2025, we’re looking at 564 million ransomware attacks targeting businesses of all sizes. If you think "This won’t happen to us," think again. Here’s what you need to know: Most attacks start with a simple phishing email. Ransom demands can reach millions—and paying doesn’t guarantee recovery. Businesses need proactive defense, not just damage control.
View Video
WatchGuard

Malware as a Service (MaaS): The New Frontier of Cybercrime

Feb 24, 2025 By Iratxe Vazquez In WatchGuard
Cybercrime has rapidly evolved, and one of the most dangerous models that has emerged in recent years is malware as a service (MaaS). This criminal business model allows anyone without advanced programming knowledge to deploy highly effective malware campaigns by paying a subscription or a one-time fee. MaaS democratizes access to malicious tools and amplifies both the quantity and sophistication of cyberattacks.
Read Post
tripwire

Protecting the Manufacturing Sector from Ransomware

Feb 24, 2025 By Josh Breaker-Rolfe In Tripwire
The manufacturing sector has long been a favorite target for ransomware actors. However, the true scale of the issue has only recently become apparent: research published in Infosecurity Magazine last December revealed that ransomware attacks on manufacturing companies have caused an estimated $17bn in downtime since 2018. But why is the manufacturing sector so vulnerable? And what can organizations do to protect themselves? Keep reading to find out.
Read Post
cyjax

How's that for a malicious Linkc, new group launches DLS

Feb 21, 2025 By Cymon In CYJAX
2024 saw data-leak sites (DLSs) for 72 extortion groups materialise. As of February 2025, Cyjax has identified DLSs for five new groups, as noted in recent blogs on extortion groups Kraken, Morpheus, GD LockerSec, and Babuk2. The fifth one to emerge goes by the name Linkc. Read on to find out what Cyjax knows so far about this new entrant into the data leak extortion scene.
Read Post

Relax, you've got Rubrik in your corner!

Feb 21, 2025 By Rubrik In Rubrik
With Rubrik Security Cloud, you’ll be unstoppable against cyberattacks. You can protect your data wherever it lives: across the enterprise, in SaaS applications, and in the cloud. You’ll also be able to continuously monitor data risks, and recover data and applications quickly. We take great pride in helping IT and security teams find peace of mind. With Rubrik, your team can rest easy knowing your data is secure and resilient.
View Video
cyberint

RansomHub: The New Kid on the Block to Know

Feb 20, 2025 By Adi Bleih In Cyberint
The RansomHub ransomware group has emerged as a significant player in the ransomware landscape, making bold claims and substantiating them with data leaks. The group emerged after the Federal Bureau of Investigation (FBI) disrupted ALPHV’s ransomware operation on December 19, 2023. There are assumptions that RansomHub is a “spiritual successor” of the ALPHV group and operates with the help of former ALPHV affiliates.
Read Post
safebreach

SafeBreach Coverage for US CERT AA25-050A [Ghost (Cringe) Ransomware]

Feb 20, 2025 By James Graham In SafeBreach
On February 19, 2025, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint advisory to disseminate known Ghost (Cring)—(“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025. Detailed information about this threat and the associated IOCs and TTPs can be seen in the advisory: Ghost (Cring) Ransomware.
Read Post
Rubrik

Enhancing Government Security with Continuous Threat Monitoring by Rubrik

Feb 19, 2025 By Andrei Uyehara In Rubrik
The government sector is facing growing cybersecurity threats that require robust solutions to safeguard sensitive data and critical infrastructure. With rapidly evolving threats—from adversarial actions from politically unstable state actors to GenAI-powered social engineering and phishing campaigns—the government sector faces a pressing need to transition from reactive threat monitoring to proactive threat monitoring.
Read Post
foresiet

Latest GitLab Vulnerabilities: A Gateway for FOG Ransomware Attacks?

Feb 19, 2025 By Foresiet In Foresiet
The future cyber threat is not static and appears to exploit vulnerabilities with fresh ransomware gangs and devastate businesses all over the world. One of such infamous gangs, Fog Ransomware, is currently dumping sensitive data of several businesses, recent attacks including GitLab deep. Foresiet security researchers believe that Fogs recently exploited Gitlab Cve perhaps they employed a fresh or unfixed zero-day vulnerability in GitLab.to launch its attacks.
Read Post
centripetal

Security Bulletin: Rha-Rha-Rhadamanthys Information Stealer

Feb 18, 2025 By Lauren Farrell In Centripetal
The origin of the word “Rhadamanthys”, goes back to Greek mythology where he was a legendary figure who ruled as king of Crete. Born to Zeus and Europa, he held the status of demigod and was renowned for his wisdom. Rhadamanthys Stealer is a sophisticated information stealer written in C++ that employs multiple evasion techniques. The malware utilizes a custom packer for code obfuscation and incorporates anti-VM and anti-debugging mechanisms to prevent analysis.
Read Post
tripwire

Ransomware: The $270 Billion Beast Shaping Cybersecurity-Insights from Cyentia's Latest Report

Feb 18, 2025 By Kirsten Doyle In Tripwire
Ransomware has evolved into one of the most devastating cyber threats of modern times, creating previously unimaginable financial and operational hardships for entities in every sector. As malicious actors employ increasingly sophisticated tools, honing their tactics and spreading their tentacles, understanding the key trends, targeted industries, and financial impact is at the heart of successfully mitigating risks.
Read Post

Can DSPM Really Help Backup Admins?

Feb 18, 2025 By Rubrik In Rubrik
In this episode of Into the Breach, James Purvis is joined by Filip Verloy to discuss a rarely explored but highly impactful topic: Can DSPM help backup administrators? Together, they dive into how DSPM enhances visibility, optimizes backup strategies, reduces costs, and strengthens cyber resilience. From managing redundant data to supporting recovery efforts during ransomware attacks, this conversation highlights DSPM's potential to revolutionize traditional backup processes while addressing modern regulatory demands.
View Video
tripwire

Advanced Ransomware Evasion Techniques in 2025

Feb 17, 2025 By Isla Sibanda In Tripwire
Ransomware has become more than a threat—it's a calculated assault on industries, wielding AI-driven precision to bypass traditional defenses. Attackers adapt faster than ever, turning cybersecurity into a high-stakes race where falling behind isn't an option. As we step into 2025, organizations face an urgent need to outthink and outmaneuver these evolving adversarial attacks.
Read Post
Rubrik

Protect Your SAP HANA Data With Air-Gapped Rubrik Solution

Feb 17, 2025 By Alpika Singh In Rubrik
SAP HANA is a multi-model database that stores data in memory instead of on disk to handle high-speed transactions and real-time analytics simultaneously. Unlike traditional databases that rely heavily on disk I/O, SAP HANA's in-memory storage allows for significantly faster query execution and data processing, making it ideal for modern enterprise workloads. SAP HANA supports both OLTP (Online Transaction Processing) and OLAP (Online Analytical Processing) workloads within a single system.
Read Post
knowbe4

New Research: Ransomware Data Extortion Skyrocketing

Feb 14, 2025 By Stu Sjouwerman In KnowBe4
Data theft extortion attacks increased by 46% in the fourth quarter of 2024, according to a new report from Nuspire. These incidents have become a routine part of ransomware attacks, since the threat of a data breach puts additional pressure on victims to pay the ransom. Ransomware gangs published stolen data on leak sites more than 2,200 times during Q4 2024. The finance and insurance industry saw the sharpest rise in data theft extortion last quarter.
Read Post
Rubrik

Will Proposed Rules for Health Industry Actually Strengthen Cybersecurity?

Feb 12, 2025 By Josh Howell In Rubrik
If you’re a US citizen, you’re likely numb to the endless letters informing you of your information being stolen yet again. For most of us, this is an annoyance and an inconvenience. But if you’re a patient in a hospital during an attack, it would be disconcerting to know that studies indicate medical errors increase by 30% when clinical applications are offline, and there’s a “small but significant” increase in patient mortality.
Read Post
ThreatQuotient

Ransomware in the Global Healthcare Industry

Feb 11, 2025 By Guest Blog In ThreatQuotient
Following the World Health Organisation (WHO) hosting a webinar to discuss the critical importance of cybersecurity in the healthcare sector, it is clear the severity of the situation the industry is facing is coming to the fore. Healthcare organizations are increasingly relying on digital systems to facilitate their daily workflow, but the prevalence of outdated legacy technology in the sector is rendering it vulnerable to cyberattacks with severe consequences.
Read Post

The AI Shared Responsibility Model: Who's Job Is It Anyway?

Feb 11, 2025 By Rubrik In Rubrik
In this episode of Into the Breach, James Purvis and Filip Verloy explore the AI Shared Responsibility Model, a framework introduced by Microsoft. They break down the roles and responsibilities of cloud providers, model providers, and customers in securing AI-powered environments. From understanding the unique challenges of generative AI tools like CoPilot to the importance of proactive data governance, this discussion offers practical insights into navigating AI security today and in the future.
View Video
knowbe4

2024 Was a Record-Breaking Year For Ransomware

Feb 10, 2025 By Stu Sjouwerman In KnowBe4
2024 saw the highest-ever amount of ransomware attacks, according to a new report from NCC Group. There were 5,263 observed ransomware incidents last year, with the LockBit gang accounting for ten percent (526) of these attacks. RansomHub was the second most active group, accounting for 501 attacks. Notably, the industrial sector was the most commonly targeted, accounting for 27% of ransomware attacks in 2024 (a 15% increase from 2023).
Read Post

A Drop in Ransomware Payments - The 443 Podcast - Episode 319

Feb 10, 2025 By WatchGuard In WatchGuard
This week on the podcast, we cover a recent report that highlights a drop in ransomware payments in 2024. After that, we discuss a recent attack targeting ASP.NET web servers before ending with a report on sensitive data leakage caused by AI model use. The 443 Security Simplified is a weekly podcast that gets inside the minds of leading white-hat hackers and security researchers, covering the latest cybersecurity headlines and trends.
View Video

Leverage generative AI securely with Rubrik DSPM

Feb 7, 2025 By Rubrik In Rubrik
Don’t let poor data visibility stop you from innovating. According to Rubrik Zero Labs, 98% of organizations report significant data visibility challenges. Rubrik DSPM gives you the control you need to reduce the risk of data exfiltration and minimize the impact of. Check out our YouTube channel to find out how you can leverage generative AI securely and prevent sensitive data leakage with Rubrik DSPM.
View Video
knowbe4

From Madison Avenue to Malware

Feb 7, 2025 By Javvad Malik In KnowBe4
In the bustling world of 1960s Madison Avenue, a young advertising executive named Lester Wunderman was about to revolutionize the industry. Wunderman, often called the father of direct marketing, had a simple yet profound insight: personalization was the key to capturing attention and driving action. Wunderman's breakthrough came when he created the Columbia Record Club, a mail-order service that tailored its offerings based on each member's past purchases and preferences. The results were staggering.
Read Post
knowbe4

Warning: Organizations Need to Prep For AI-Powered Ransomware Attacks

Feb 6, 2025 By Stu Sjouwerman In KnowBe4
The rise of agentic AI tools will transform the cybercrime landscape, according to a new report from Malwarebytes. Agentic AI—which is still under development—is a step above the generative AI tools that are currently available to the public, and will likely be widely released in 2025. While these tools will have many legitimate uses, they’ll also enable cybercriminals to scale their attacks.
Read Post
Trustwave

Will the UK's Ransomware Proposal Work? Trustwave Weighs in on the Potential Impact

Feb 6, 2025 By Trustwave In Trustwave
The recent UK Home Office proposal designed to hinder and disrupt ransomware operations through several proposed measures, including a targeted ban on ransomware payments, has again brought this question into the public square. The question of whether to pay a ransom demand is a decades-long argument with ardent opinions on both sides.
Read Post

AI Powered Data Classification: A Game Changer or Just Hype?

Feb 5, 2025 By Rubrik In Rubrik
In this episode of Into the Breach, James Purvis, Drew Russell, and Dan Eldad dive into the exciting yet complex world of AI-powered data classification. Is it truly a game changer, or just overhyped? They explore the potential of AI to revolutionize data classification, its limitations, and where traditional methods still hold value. The discussion also covers practical use cases, cost implications, and the future of AI in data security.
View Video
Trustwave

Trustwave SpiderLabs: Examining How New Ransomware Groups Emerge

Feb 4, 2025 By Trustwave In Trustwave
Two newcomers have made their way onto the ransomware threat group stage, becoming the biggest threat to the energy and utilities sector in 2025. According to the most recent data from Trustwave SpiderLabs’ Energy and Utilities Sector Deep Dive: Ransomware Threat Groups, Hunters International and Qilin (pronounced Chee Lin) displaced LockBit as the most active group attacking these sectors.
Read Post
opti9

Securing Microsoft 365 in the Age of Ransomware

Feb 4, 2025 By Shannon Peck In Opti9
Here are the top five reasons why safeguarding your M365 environment is critical, especially in recent years: Our team of experienced security experts here at Opti9 have devised a comprehensive list of actionable items to improve the security posture of your Microsoft 365 environments. Here are a few action items to properly protect your Microsoft 365 environment.
Read Post
knowbe4

Warning: Phishing Campaign Targets Germany with New Malware

Feb 3, 2025 By Stu Sjouwerman In KnowBe4
Researchers at Cisco Talos warn that a new phishing campaign is targeting users in Germany and Poland in an attempt to deliver several strains of malware, including a new backdoor dubbed “TorNet.” The phishing emails purport to be fake money transfer confirmations from financial institutions or phony order receipts from manufacturing and logistics companies.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.