Discover more from ESSGroup
Subscribe to get the latest posts sent to your email.
The year 2024 has seen a significant rise in ransomware attacks targeting organizations across various sectors. This report provides an in-depth analysis of the ransomware incidents reported throughout the year, highlighting key metrics and analytics to help understand the scope and impact of these cyber threats.
Month | Number of Attacks |
---|---|
January | 7 |
February | 24 |
March | 8 |
April | 9 |
May | 5 |
June | 3 |
July | 1 |
August | 0 |
September | 1 |
October | 0 |
November | 0 |
December | 0 |
Sector | Number of Attacks |
---|---|
Business Services | 21 |
Technology | 16 |
Manufacturing | 11 |
Transportation/Logistics | 7 |
Government (Religious Organization) | 3 |
Ransomware Group | Number of Attacks |
---|---|
Lockbit3 | 23 |
Blackbasta | 20 |
8base | 10 |
Rhysida | 2 |
Unsafe | 2 |
Sector | Total Data Compromised (GB) |
---|---|
Business Services | 15,600 |
Technology | 9,800 |
Manufacturing | 7,200 |
Transportation/Logistics | 3,400 |
Government (Religious Organization) | 500 |
The year 2024 has been marked by a surge in ransomware attacks, affecting organizations across various sectors. By understanding the key metrics and analytics presented in this report, organizations can better prepare and protect themselves against these evolving cyber threats. Enhanced cybersecurity measures, incident response plans, and collaboration with authorities are crucial steps in mitigating the impact of ransomware attacks.
Subscribe to get the latest posts sent to your email.
Lorem Ipsum is simply dummy text of the printing and typesetting
industry. Lorem Ipsum has been the industry's
Threat Overview
A significant cyber threat has been identified and detailed in a report published by AlienVault. The report, titled “No Honor Among Thieves: Uncovering a Trojanized XWorm RAT Builder Propagated by Threat Actors and Disrupting Its Operations”, highlights the weaponization of a trojanized version of the XWorm RAT builder.
Threat Summary
The malware, targeted at novice cybersecurity enthusiasts, was propagated through popular platforms such as GitHub, Telegram, and file-sharing services. Over 18,459 devices worldwide have been compromised, with sensitive data like browser credentials, Discord tokens, and system information being exfiltrated.
Tactics Employed
To evade detection and maintain persistence, the malware employs advanced techniques:
Command-and-Control Infrastructure
The malware leverages Telegram as its command-and-control infrastructure, utilizing bot tokens and API calls.
Data Exfiltration
Over 1 GB of browser credentials has been exfiltrated from multiple devices,
Threat Actors Involved
Attribution efforts have linked the operation to a threat actor using aliases such as ‘@shinyenigma’ and ‘@milleniumrat’.
Disruption Efforts
Researchers discovered a ‘kill switch’ feature that was employed to disrupt active devices.
Recommendations
Based on this report, the following recommendations are provided:
Resources
Full report available at:
https://www.cloudsek.com/blog/no-honour-among-thieves-uncovering-a-trojanized-xworm-rat-builder-propagated-by-threat-actors-and-disrupting-its-operations
Security Operation Center Threat Report
Threat Overview
The Security Operations Center has recently identified and analyzed a new threat report titled Weaver Ant: Tracking a China-Nexus Cyber Espionage Operation. Published by CyberHunter_NL on March 24, 2025, this report provides critical insights into an ongoing cyber espionage operation with alleged ties to Chinese state-sponsored actors.
Threat Report Details
The Weaver Ant threat report is highly reliable, with a confidence level of 100 and a reliability rating of A – Completely reliable. It includes 102 connected elements, offering a comprehensive view of the threat landscape associated with this operation. The report can be accessed through external references provided by Sygnia and AlienVault’s Open Threat Exchange (OTX).
Short Description
The Weaver Ant group is known for its sophisticated cyber espionage activities targeting various sectors globally. This particular report delves into their tactics, techniques, and procedures (TTPs), providing valuable information for defenders to better protect their networks.
Understanding the Threat
The Weaver Ant operation primarily focuses on data exfiltration and long-term persistence within targeted networks. The group employs a variety of malware families and tools designed to evade detection and maintain access over extended periods. Key indicators of compromise (IOCs) include specific IP addresses, domain names, file hashes, and command-and-control (C2) infrastructure.
Tactics, Techniques, and Procedures
The report outlines several TTPs used by the Weaver Ant group:
Recommendations for Mitigation
To protect against the Weaver Ant threat, organizations should consider implementing the following recommendations:
Conclusion
The Weaver Ant threat report provides valuable insights into the tactics and techniques used by state-sponsored cyber espionage groups. By understanding these TTPs and implementing robust security measures, organizations can better protect their networks and sensitive information from such advanced threats. For more detailed information, please refer to the external references provided in this report.
Additional Information
For further details on the Weaver Ant threat operation, you can visit the following links:
This report is crucial for security professionals to stay ahead of emerging threats and ensure the protection of their organizations’ critical assets.
In early February 2025, the eSentire Threat Response Unit detected a sophisticated phishing attack associated with Sneaky2FA, an Adversary-in-the-Middle Phishing-as-a-Service kit designed to bypass two-factor authentication (MFA). This threat report delves into the details of this attack, its implications, and provides recommendations for mitigating such threats.
The attack began with a spam email containing a link to a phishing PDF hosted on OneDrive. Unsuspecting users who clicked the link were redirected to a fake Office 365 login page. This phishing page was protected by Cloudflare Turnstile, a service designed to prevent automated scanners from accessing it, adding an extra layer of deception.
Sneaky2FA is particularly dangerous because it captures not only user credentials but also 2FA codes. By doing so, the attackers gain session cookies that allow them to access accounts without triggering any MFA prompts. This method effectively bypasses the security measures put in place by multi-factor authentication systems.
The phishing operators were observed using stolen cookies to add additional MFA methods to compromised accounts. This tactic allows them to maintain persistent access even if the initial credentials are changed. The use of VPN and proxy services further obscures their activities, making it difficult for security teams to trace the origin of the attacks.
The sophistication of Sneaky2FA enables a range of damaging follow-on activities. Once inside an organization’s network, attackers can exfiltrate sensitive emails, launch spam campaigns, and conduct Business Email Compromise (BEC) attacks. These activities can lead to significant financial losses and reputational damage for the targeted organizations.
To mitigate the risks posed by Sneaky2FA and similar threats, organizations should implement a multi-layered security approach. Here are some recommendations:
Incident Response Plan: Develop and regularly update an incident response plan to quickly detect, respond to, and mitigate the impact of phishing attacks. Ensure that all employees are aware of their roles and responsibilities during a security incident.
Regular Audits: Conduct regular security audits to identify vulnerabilities in your systems and processes. Address any identified weaknesses promptly to minimize the risk of successful attacks.
Third-Party Risk Management: Evaluate the security practices of third-party vendors and service providers. Ensure that they adhere to stringent security standards and regularly review their compliance with these standards.
The detection of Sneaky2FA highlights the evolving nature of cyber threats and the need for organizations to stay vigilant. By implementing robust security measures and fostering a culture of cybersecurity awareness, organizations can better protect themselves against sophisticated phishing attacks and other malicious activities.
For additional information on this threat report, please refer to the following external references:
This report underscores the importance of staying informed about emerging threats and taking proactive steps to enhance cybersecurity defenses. By understanding the tactics used by attackers like Sneaky2FA, organizations can better prepare themselves to defend against similar threats in the future.
Subscribe now to keep reading and get access to the full archive.