August Cybersecurity Roundup: Ransomware Activity, Attacks and Takedowns
Summary
Darkowl’s August roundup covers ransomware trends, phishing and malware attacks, indictments, account takedowns, a ransomware operation disrupted by the FBI, and a joint advisory on Iran-based actors targeting U.S. organizations.
Key points
- TRM Labs data cited in the roundup says Russian-speaking ransomware groups accounted for 69% of cryptocurrency ransom payments in 2023, totaling more than $500 million.
- CERT-UA reported that phishing emails impersonating Ukraine’s Security Service led to AnonVNC malware infecting more than 100 government systems.
- The U.S. indicted North Korean national Rim Jong Hyok over alleged ransomware attacks on hospitals and other intrusions; the State Department announced a reward of up to $10 million for information leading to his location.
- Meta said it removed 63,000 Instagram accounts linked to sextortion scams, along with more than 7,000 Nigeria-based Facebook accounts, groups, and pages associated with scam activity.
- The FBI and international partners disrupted the Dispossessor ransomware operation, seizing servers and criminal domains across the U.S., U.K., and Germany.
- South Korea’s NCSC warned that North Korean groups exploited a VPN software update to distribute malware in campaigns against South Korean entities.
- The FBI, CISA, and DC3 warned that Iran-based actors target U.S. organizations and may develop network access for ransomware affiliates.
Article Details
- Event Type
- Monthly roundup of cybersecurity news covering ransomware activity, phishing and malware campaigns, law-enforcement disruptions, cybercrime, and state-linked threat activity.
- Impact
- Reported incidents include ransomware attacks against hospitals and other U.S. organizations; compromise of more than 100 systems at Ukrainian government agencies; scams targeting users on Instagram and Facebook; and a cyberattack on a Taiwanese government-affiliated research institute. Authorities also disrupted the Dispossessor ransomware operation, while the roundup reports threat activity attributed to North Korean, Chinese, and Iran-based actors.
People
Threat Actors
Black BastaRansomware operation listed among the dominant operations in 2023.BlackCatRansomware operation listed among the dominant operations in 2023.Cl0pRansomware operation listed among the dominant operations in 2023.LockBitRansomware operation listed among the dominant operations in 2023.PlayRansomware operation listed among the dominant operations in 2023.
Malware
Vendors
Products
Facebook“Yahoo Boys.” In addition to the Instagram accounts, Meta also removed more than 7,000 Nigeria-based Facebook accounts, groups, and pages, that were sharing tips on how to conduct scams.Instagram4. – Meta nukes massive Instagram sextortion network of 63,000 accounts – BleepingComputerTelegram5. Telegram CEO Pavel Durov charged by French prosecutors – CNBCVPN7. North Korean hackers exploit VPN update flaw to install malware – BleepingComputer
Tools
Countries
FranceOn August 24, Russian multi-billionaire Pavel Durov, the founder and CEO of the messaging app Telegram, was arrested in France on a warrant in relation to an investigation into criminal activity on Telegram.Iran9. Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations – CISANigeriaOn July 24, Meta announced that it had taken down 63,000 Instagram accounts registered in Nigeria that were connected to sextortion scams.North KoreaWhile North Korea currently leads in cryptocurrency stolen through exploits and breaches, according to the most recent numbers Russia continues to dominate all other malicious activity involving cryptocurrency.RussiaWhile North Korea currently leads in cryptocurrency stolen through exploits and breaches, according to the most recent numbers Russia continues to dominate all other malicious activity involving cryptocurrency.South KoreaIn a recent advisory, South Korea’s National Cyber Security Center (NCSC) warned that state-backed North Korean hacker groups Kimsuky (APT43) and Andariel (APT45)—previously linked to the Lazarus Group—have carried outUkraine2. Hackers posing as Ukraine’s Security Service infect 100 govt PCs – BleepingComputerUnited StatesDepartment of Justice (DoJ) indicted Rim Jong Hyok, a North Korean national, for his involvement in ransomware attacks against healthcare facilities in the United States.
Industries
Constructionlinked to the Lazarus Group—have carried out campaigns against South Korean entities, notably in the construction sector.Defensehospitals to “fund additional computer intrusions into defense, technology, and government entities worldwide.” On the same day as the DoJ indictment, the U.S.EducationTargeted sectors have included healthcare, defense, and education.HealthcareDepartment of Justice (DoJ) indicted Rim Jong Hyok, a North Korean national, for his involvement in ransomware attacks against healthcare facilities in the United States.