GISEC Global 2023 was 🔥

Group-IB was excited to be part of the Middle East’s largest and most impactful cybersecurity event, which brought together the leading cybersecurity brands and experts!

With cyber threats evolving, it's vital to share knowledge, develop best practices, boost cyber resilience and contribute to the global fight against cybercrime. The Group-IB team was happy to share our fresh insights and show how our products can help you stay ahead of cybercriminals.

#GISECGlobal #FightAgainstCybercrime

👨‍💻The job hunt can be an extremely trying experience at the best of times, and a fake job scam campaign doesn't make it easier.

Fake job vacancies are one type of scam that is growing in visibility in the Middle East and Africa region. Group-IB’s Digital Risk Protection uncovered more than 2,400 scam pages on Facebook advertising fake jobs for Arabic speakers. On these pages, scammers spoofed more than 40 of the MEA region’s largest enterprises and published vacancies offering salaries that are too good to be true; a social engineering ploy that aims to get the victims to interact with the post. The eventual goal of the threat actors is the theft of the user’s social network account credentials.

Check out our fresh blog post to get more details on this scam scheme as well as recommendations for users and companies. Read👈

#scam

🔍 In January 2023, Group-IB’s Digital Forensics and Incident Response team investigated an attack against an industrial sector company in Europe. Our experts established that the victim had been encrypted with a previously unknown ransomware strain. The strain was codenamed BabLock, because its versions for Linux and ESXi share similarities with the leaked Babuk ransomware. Despite these slight similarities, the group has a very distinct modus operandi and custom sophisticated ransomware for Windows. Additionally, the BabLock gang (also tracked under the name “Rorschach”), unlike most of its “industry peers”, is not using a dedicated leak site and is communicating with its victims via email. Group-IB researchers immediately notified the company’s customers of its discovery.

Check out our new blog post to get a comprehensive description of the BabLock attack: their toolset, the strain’s samples for Windows, ESXi, and Linux as well as TTPs used by the BabLock gang mapped to MITRE ATT&CK®. Read👈

#ransomware #BabLock

Group-IB’s Threat Intelligence team identified new infrastructure used by APT MuddyWater. We also uncovered that this group uses SimpleHelp, a legitimate remote device control and management tool, to ensure persistence on victim devices.

According to our data, MuddyWater used SimpleHelp for the first time on June 30, 2022. At the time of writing, the group has at least eight servers on which they have SimpleHelp installed.

Our new blog post describes MuddyWater’s previously unknown infrastructure and points to links with some of the group’s publicly known IP addresses. Read now👈

#APT #MuddyWater