Back

Ransomware: Activity Levels Remain High Despite Disruption

July 11, 2024, 1:35 p.m.

Tags

ransomware
lockbit
vulnerability
blackcat
alphv
encryption
phobos
cyclops blink
CVE-2024-4577
noberus
tellyouthepass
blacksuit
2024-07-11
akira
warp av killer
qilin
disruption

External References

https://symantec-enterprise-blogs.security.com/

https://otx.alienvault.com/

Description

While overall activity levels dipped slightly in the first quarter of 2024, the number of claimed attacks remained high, with LockBit accounting for over 20%. The report explores the changing tactics employed by ransomware actors, including the exploitation of vulnerabilities, the use of Bring-Your-Own-Vulnerable-Driver techniques, and the return of the Clop ransomware by the Snakefly group.

Date

Published Created Modified
July 11, 2024, 1:06 p.m. July 11, 2024, 1:06 p.m. July 11, 2024, 1:35 p.m.

Indicators

f572898ab9f9a0fabac77d5d388680f84f85f9eb2c01b4e5de426430c6b5008f

f6afa84b0847414220bb15517b8b5e2c505b64b53efbba73b753379c66ac5017

ea59d6a130a279dfde4df53640bd720419c7b5d9711a21a78af9453b1b3b5805

bef2d817f1813eb0629222112fd3721865a2a4eb1f4d51ad1f09fd807d4380ab

d18453e564ca27514227478f225d85811fe15d08aa5fb1f613022c43155c5c54

aa43f34c3fa67aea994c1babeb71b46c7b24eccaa0455ae21aa561e251e7cc4d

aa0ef20f9f8ca111b0d8a550daf6651f5b0557f0acb0a26545755c5a02263a9b

a702a671b7911a09ccb5b4f42923e8b301e0bbb851443dd52622022959a3055a

88efa81984852dac62d325f2091a09de1e6423a711d7913aeac103c50664cf84

7d6877eb8a3e2da1e8b06e2ed41604c6c3d5ced8293f7cc7e760ba972303bd0e

7101db8cb05e989c018ebc5df47819029cd76c4093b22c4582288795e46f6689

6fb438feeb8369c5b82bfaa77144a641f7645c321f0b24dd97cfe2687b1ebd44

67e4c18e80d4d1acb9395f4a1fe9c2a75d95fcccdb33bcdd5259ba6f47e60e57

6192488729850a7a28498f233346e856b0097e4b3160baa641f8cf9571b56da8

5e446efb6c4f296fb8f25ef7a1a0a482f51dc475bd5ef3e89be9d43782a9f60f

4de4621da1b7da597c2c8def4c08b8d405672dadb9c70d7dffd647c8d6abd394

4d571f4d0008deb01e3144e0e3d5f882c5422acfcb4dd260082852a822d8d2fb

3f41e2ceff3a04cd6de6aadce7e7b7c8584940e4320a7db55dd712debb061510

38f0750cbe49b30db326b53b9f752b66c4f5e23cc3bbbd6d1844e2878a19b9a7

2881194b7e0939d47165c894c891737d8c189ee8fb4720e814a4bcdd804d00d1

2fc2d747847eb04561a435e65954f0103101e2190458eb3c125deda49326c597

21ff399e57cc306a1ae1daab6009ea40c8aa96c39296d0f8781626de6bd19256

170d654b61810992fef6f18dbce5b4c7f5762cf36c9b41c36a14c9f6609f6e7d

1453179d46ef89eb780f8b82632f352017a3586e8d49fc3f087f633f7bebbf0a

9562ad2c173b107a2baa7a4986825b52e881a935deb4356bf8b80b1ec6d41c53

95279881525d4ed4ce25777bb967ab87659e7f72235b76f9530456b48a00bac3

3e65437f910f1f4e93809b81c19942ef74aa250ae228caca0b278fc523ad47c5

Attack Patterns

Warp AV Killer

Qilin

TellYouThePass

Cyclops Blink - S0687

BlackCat - S1068

Play

Noberus

Blacksuit

Akira

ALPHV

Phobos

LockBit

T1548

T1572

T1546

T1505

T1489

T1486

T1083

T1543

T1055

T1498

T1592

T1204

T1053

T1195

T1190

T1059

CVE-2024-4577