The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Ghost (Cring)— (“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025. Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware.
This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Related:
- Microsoft disrupts global cybercrime subscription service responsible for millions in fraud losses
January 14, 2026
Today, Microsoft is announcing a coordinated legal action in the United States and, for the first time, the United Kingdom to disrupt RedVDS, a global cybercrime subscription service fueling millions in fraud losses. These efforts are part of a broader joint operation with international law enforcement, including German authorities and Europol, which has allowed Microsoft and ...
- US cargo tech company publicly exposed its shipping systems and customer data to the web
January 14, 2026
For the past year, security researchers have been urging the global shipping industry to shore up their cyber defenses after a spate of cargo thefts were linked to hackers. The researchers say they have seen elaborate hacks targeting logistics companies to hijack and redirect large amounts of their customers’ products into the hands of criminals, in ...
- China: Authorities tell domestic companies to stop using US and Israeli cybersecurity software
January 14, 2026
Chinese authorities have told domestic companies to stop using cybersecurity software made by more than a dozen firms from the U.S. and Israel due to national security concerns, three people briefed on the matter said. As trade and diplomatic tensions flare between China and the U.S. and both sides vie for tech supremacy, Beijing has been ...
- Hackers claim to have Target source code for sale following recent cyberattack
January 13, 2026
Hackers are apparently selling internal source code stolen from American retail giant Target. A previously unknown threat actor posted in an underground hacking community to claim they were selling Target’s data, and that this was the first of many datasets to go on auction. To support their claim, the poster created multiple repositories on Gitea, a ...
- Man to plead guilty to hacking US Supreme Court filing system
January 13, 2026
A resident of Springfield, Tennessee, is expected to plead guilty to hacking the U.S. Supreme Court’s electronic document filing system dozens of times over several months. Prosecutors say between August and October 2023, Nicholas Moore, 24, “intentionally accessed a computer without authorization on 25 different days and thereby obtained information from a protected computer,” according to ...
- Paris releases Russian athlete accused by Washington of hacking attempts
January 10, 2026
Authorities in France have released a Russian national accused by the United States of participating in hacking attacks on companies for ransom in cryptocurrency. The man has been exchanged for a French citizen held in Russian custody, instead of being handed over to the U.S. The swap has been compared to the Griner case. Daniil Kasatkin, a ...