Rückblick secIT 2025: Patentrezepte gegen Cybercrime und 21 kg Espressobohnen
Die IT-Security-Konferenzmesse secIT lockte abermals tausende Admins und CISOs nach Hannover und war ein voller Erfolg. Im Herbst geht es weiter.
New ransom group blog post!
Group name: ransomhub
Post title: cisd.org
Info: https://cti.fyi/groups/ransomhub.html
December 2023: US District Attorney Jessica Aber indicts 4 Russians for war crimes in #Ukraine
September 2024: US District Attorney Jessica Aber indicts Russian cryptocurrency money launderer / cybercriminal #SergeyIvanov
November 2024: US District Attorney Jessica Aber accuses Virginia based companies of running "three different schemes to illegally transship sensitive American technology to Russia," including sending equipment to a Russian telecommunications company linked to the #Kremlin and Russia's notorious #FSB security agency.
March 2025: Former US District Attorney Jessica Aber found dead at age 43
Dealing with something ridiculous at the moment that is a great example of just how 'easy' it really is to close down exposed data:
Found a server recently with no access controls at all that was hit by ransomware in May 2024 and most of the data is encrypted. (It got hit by an automated script, it wasn't targeted by a ransom group)
Found a non encrypted directory:
The company is STILL uploading, monthly, hundreds of millions of records of logs with their clients data.
Tried to reach out to the company, nothing. Company is from AUS so I tried ASD, nothing.
I sent an email to AUSCERT, they validated with me the issue and forwarded the information and my contact to ASD, they also tried to reach out to the company themselves.
Not a word from anyone and the server is still exposed a month after my initial alerts.
Logs are still being uploaded to the server so it's obvious no one did anything.
So what am I supposed to do here?
CERT.at investigates ransomware attacks via critical Fortinet vulnerabilities (FortiOS, FortiProxy) and recommends urgent forensic investigations of all devices that didn't have FortiOS 7.0.16 installed before 2025-01-27, when the PoC for CVE-2024-55591 was published. Those devices may be compromised despite having been patched later.
Check (German) warning by @CERT_at
https://www.cert.at/de/warnungen/2025/3/ransomware-gruppen-nutzen-weiterhin-kritische-fortinet-schwachstellen-warnung-vor-gepatchten-aber-bereits-kompromittierten-geraten
Long story with Forescout:
https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/
Black Basta ransomware group is indeed dead, post hack and dump of their chats. #threatintel #ransomware
Hackers are exploiting #Fortinet firewall bugs to plant #ransomware
https://techcrunch.com/2025/03/17/hackers-are-exploiting-fortinet-firewall-bugs-to-plant-ransomware/
Rostislav Panev, a 51-year-old Russian and Israeli national, has been extradited to the United States. He is suspected of being a developer for LockBit.
#LockBit #Russia #cybersecurity #ransomware
https://cnews.link/lockbit-ransomware-developer-extradited-to-the-us-1/
@kkarhan@infosec.spaceDass @Lilith nur "#PR-Kopfschmerzen" macht und nicht bei irgendeiner #Ransomware-Gang als Affiliate agiert ist mehr Glück als Verstand.
Ransomware gang creates tool to automate VPN brute-force attacks
The Black Basta ransomware operation created an automated brute-forcing framework dubbed 'BRUTED' to breach edge networking devices like firewalls and VPNs.
DeepSeek's reasoning model R1 can easily be tricked into generating malicious code, even though it still needs human input, research shows.
#Deepseek #ransomware #cybersecurity #AI
https://cnews.link/deepseek-malware-generation-keylogger-ransomware-1/
#TataTechnologies’ data leaked by #ransomware gang
https://techcrunch.com/2025/03/11/tata-technologies-data-leaked-by-ransomware-gang/
New ransom group blog posts!
Group name: arcusmedia
Post title: HYPERNOVA TELECOM
Info: https://cti.fyi/groups/arcusmedia.html
Group name: arcusmedia
Post title: HYPONAMIRU
Info: https://cti.fyi/groups/arcusmedia.html
@0x58@infosec.exchange
Latest issue of my curated #cybersecurity and #infosec list of resources for week #10/2025 is out!
It includes the following and much more:
➝ #CYBERCOM and #CISA Told to Stop Tracking #Russia Actors;
➝ Alleged Black Basta #Ransomware Leader Escapes from Court;
➝ #VMWare 0day Vulnerabilities Being Exploited - Patch Now;
➝ Gang Claims Responsibility on Tata Technologies Breach;
➝ The Great Firewall of #China is Bleeding;
Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end 
https://infosec-mashup.santolaria.net/p/template-infosec-mashup-xx-2025-b3ff0d41bdc019b3
