Since September 2024, Interlock ransomware actors have impacted a wide range of businesses and critical infrastructure sectors in North America and Europe.
These actors are opportunistic and financially motivated in nature and employ tactics to infiltrate and disrupt the victim’s ability to provide their essential services. Interlock actors leverage a double extortion model, in which they both encrypt and exfiltrate victim data. Ransom notes do not include an initial ransom demand or payment instructions; instead, victims are provided with a unique code and are instructed to contact the ransomware group via a .onion URL through the Tor browser. To date, Interlock actors have been observed encrypting VMs, leaving hosts, workstations, and physical servers unaffected; however, this does not mean they will not expand to these systems in the future.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Nelnet Servicing breach exposes data of 2.5M student loan accounts
August 29, 2022
Data for over 2.5 million individuals with student loans from Oklahoma Student Loan Authority (OSLA) and EdFinancial was exposed after hackers breached the systems of technology services provider Nelnet Servicing. Technology services from Nelnet Servicing, including a web portal, are used by OSLA and EdFinancial to give online access students taking out a loan access to ...
- US ‘actively defending against foreign interference and influence’ in midterms, Cyber Command says
August 25, 2022
US military and intelligence officials are stepping up their efforts to defend the electoral process from foreign hacking and disinformation as the November midterms approach, officials said Thursday. Officials are “actively defending against foreign interference and influence operations in U.S. elections,” US Cyber Command and the National Security Agency said in a statement, “specifically by focusing ...
- Twitter, Meta kill hundreds of pro-Western troll accounts
August 25, 2022
Well known for an abundance of anti-western troll accounts and propaganda, Twitter and Meta are reporting that they’ve taken down nearly 200 accounts that, for the past five years, have been amplifying pro-Western messages in the Middle East and Central Asia. Stanford Internet Observatory (SIO) and Graphika, a social media analytics company, have published a report ...
- CISA: Preparing Critical Infrastructure for Post-Quantum Cryptography
August 24, 2022
Nation-states and private companies are actively pursuing the capabilities of quantum computers. Quantum computing opens up exciting new possibilities; however, the consequences of this new technology include threats to the current cryptographic standards. These standards ensure data confidentiality and integrity and support key elements of network security. While quantum computing technology capable of breaking public ...
- CISA Releases Cybersecurity Toolkit to Protect U.S. Elections
August 10, 2022
CISA—through the Joint Cyber Defense Collaborative (JCDC)—has released a toolkit of free cybersecurity resources for the election community. The toolkit aims to help state and local government officials, election officials, and vendors enhance the cybersecurity and cyber resilience of U.S. election infrastructure. The toolkit resources, which come from CISA, JCDC members, and others across the cybersecurity ...
- Former Twitter worker convicted of spying for Saudi Arabia
August 10, 2022
A former Twitter employee has been convicted of failing to register as an agent for Saudi Arabia and other charges after accessing private data on users critical of the kingdom’s government in a spy case that spanned from Silicon Valley to the Middle East. Ahmad Abouammo, a U.S. citizen and former media partnership manager for Twitter’s ...