Let's dive a little bit deeper into the ransomware threat. According to the latest edition of Group-IB’s annual Hi-Tech Crime Trends report, ransomware will remain the top threat for organizations and businesses in 2023.

Here are some highlights:

📍Across the globe, 2,886 companies had their information, files, and data published on ransomware DLS between H2 2021 – H1 2022.

📍The top five most affected countries were the United States, Germany, United Kingdom, Canada, and Italy.

📍The largest number of ransomware-related data leak victims were found in the following sectors: manufacturing, real estate, professional services, and transportation industries.

📍The most active ransomware groups in H2 2021 – H1 2022 were Lockbit, Conti, and Hive.

Want to learn more about Group-IB's findings on ransomware and other cyberthreats? Download our newest report Hi-Tech Crime Trends 2022/2023👈

#HiTechCrimeTrends #report #ransomware

🔮A little cybersecurity forecast never hurt nobody. We have put together the top cyber threats that you need to be aware of in 2023, according to Group-IB's annual Hi-Tech Crime Trends report.

Make sure to download the full report👈

#HiTechCrimeTrends #report

📨 It all started with an email...

In the summer of 2022, the Group-IB Managed Extended Detection and Response (MXDR) solution successfully detected and blocked an email carrying a malicious attachment. This email was intended for Group-IB’s employees.

While analyzing this attack, the Group-IB Threat Intelligence team found patterns in the actions of the attackers and attributed the observed TTPs to the Tonto Team (aka HeartBeat, Karma Panda, CactusPete, Bronze Huntley, Earth Akhlut). What else did we find out about the threat actor?

▪️The attackers used phishing emails to deliver malicious Microsoft Office documents created with the Royal Road Weaponizer, a tool widely used by Chinese nation-state threat actors.

▪️During the attack, Group-IB researchers noticed the use of the Bisonal.DoubleT backdoor. Bisonal.DoubleT is a unique tool developed by the Tonto Team APT.

▪️The attackers used a new downloader that Group-IB analysts named TontoTeam.Downloader (aka QuickMute).

Check out our fresh blog where we provide indicators of compromise associated with the Tonto Team campaign and detailed analysis of the tools, techniques, and procedures (TTPs) of the threat actor. This information is useful for organizations fighting cybercrime and information security professionals — chief information officers, SOC analysts, and incident responders — in other sectors targeted by the Tonto Team. Read👈

#APT #TontoTeam

🐍 Old snake, new skin.

Group-IB Threat Intelligence team uncovered a previously undocumented spear phishing campaign carried out by the nation-state cyber threat actor SideWinder between June and November 2021. For the first time, Group-IB researchers confirmed the links between the SideWinder, Baby Elephant, and Donot APT groups and described the entire arsenal of the cyberespionage group, including newly discovered tools. What else?

▪️SideWinder has been systematically attacking government organizations in South and East Asia for espionage purposes for about 10 years.

▪️The attackers attempted to target 61 government, military, law enforcement, and other organizations in Afghanistan, Bhutan, Myanmar, Nepal, and Sri Lanka.

▪️Group-IB specialists analyzed SideWinder’s network infrastructure and found numerous phishing resources, including a spear-phishing project targeting the crypto industry.

▪️Among the newly discovered tools were SideWinder.RAT.b (a remote access Trojan) and SideWinder.StealerPy, which is a custom information stealer written in Python designed to exfiltrate information collected from the victim’s computer.

Curious to know more? Download Group-IB’s new report "Old snake, new skin: Analysis of SideWinder APT activity between June and November 2021". The report contains YARA rules for hunting the group and a table with the group’s TTPs (Tactics, Techniques, and Procedures) mapped to the MITRE ATT&CK® matrix, providing all the information companies and organizations needed to update their security controls to detect SideWinder. Download👈

#APT #SideWinder