📦 What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?

Dubai-based researchers from Group-IB’s Digital Forensics and Incident Response (DFIR) team found that malicious actors, instead of simply infecting a computer with ransomware, have taken to packaging a whole host of malicious files into what we call malware bundles.

Malware bundles have been around for a while, but their recent usage by cybercriminals reveals some interesting trends. First, it highlights how threat actors, with their ever-growing appetite for cash, create new approaches for monetization. Secondly, their usage can reveal insights into the interactions between low-skilled threat actors and their more sophisticated counterparts. An entry-level cybercriminal can leverage a malware bundle to gain access to a single computer, but they are also able to sell this access to a more-skilled threat actor who is able to move laterally from a single device to an entire corporate network.

Check out our latest blog post to get the insights from our investigations into affected companies in Egypt, South Africa, Saudi Arabia, Turkey, Morocco, UAE, Kenya, Israel, Pakistan, India, and Germany. We discuss channels of delivery, malware attribution, tactics, techniques and procedures (TTPs), and bundled parts and roles, all in reference to the MITRE ATT&CK® (Adversarial Tactics, Techniques & Common Knowledge) framework, in order to detail how the cybercriminals gained initial access and secured persistence. Read now👈

#ransomware

Want to learn how to monitor for IS incidents, detect threats, eliminate false positives, and perform initial incident response? Register for the "Blue Team Analyst" training course by Group-IB!

In three days, you’ll know how to:

▪️Monitor all solutions to ensure that the organization is secure;
▪️Quickly assess security incidents and determine the main features of a cyberattack;
▪️Support threat intelligence and threat hunting processes.

It's time to enhance your skills! Register now👈

#education

We are happy to announce that Group-IB has been awarded a Cybersecurity Service Provider License. The license issued by the Cybersecurity Services Regulation Office of Singapore (CSRO) enables Group-IB to provide Penetration Testing and Managed Security Operations Centre (SOC) Monitoring Services.

To obtain a license, Group-IB went through a rigorous 6-month evaluation process that involved demonstrating its high level of experience and technological capabilities in providing pentesting and managed Security Operations Centre monitoring services. The licensing process also evaluated the company services’ compliance with Singapore’s Cybersecurity Act which limits the provision of such services to licensed entities.

Check out our website for more details👈

#FightAgainstCybercrime