Ransomware: Activity Levels Remain High Despite Disruption
July 11, 2024, 1:35 p.m.
Tags
External References
Description
While overall activity levels dipped slightly in the first quarter of 2024, the number of claimed attacks remained high, with LockBit accounting for over 20%. The report explores the changing tactics employed by ransomware actors, including the exploitation of vulnerabilities, the use of Bring-Your-Own-Vulnerable-Driver techniques, and the return of the Clop ransomware by the Snakefly group.
Date
Published: July 11, 2024, 1:06 p.m.
Created: July 11, 2024, 1:06 p.m.
Modified: July 11, 2024, 1:35 p.m.
Indicators
f572898ab9f9a0fabac77d5d388680f84f85f9eb2c01b4e5de426430c6b5008f
f6afa84b0847414220bb15517b8b5e2c505b64b53efbba73b753379c66ac5017
ea59d6a130a279dfde4df53640bd720419c7b5d9711a21a78af9453b1b3b5805
bef2d817f1813eb0629222112fd3721865a2a4eb1f4d51ad1f09fd807d4380ab
d18453e564ca27514227478f225d85811fe15d08aa5fb1f613022c43155c5c54
aa43f34c3fa67aea994c1babeb71b46c7b24eccaa0455ae21aa561e251e7cc4d
aa0ef20f9f8ca111b0d8a550daf6651f5b0557f0acb0a26545755c5a02263a9b
a702a671b7911a09ccb5b4f42923e8b301e0bbb851443dd52622022959a3055a
88efa81984852dac62d325f2091a09de1e6423a711d7913aeac103c50664cf84
7d6877eb8a3e2da1e8b06e2ed41604c6c3d5ced8293f7cc7e760ba972303bd0e
7101db8cb05e989c018ebc5df47819029cd76c4093b22c4582288795e46f6689
6fb438feeb8369c5b82bfaa77144a641f7645c321f0b24dd97cfe2687b1ebd44
67e4c18e80d4d1acb9395f4a1fe9c2a75d95fcccdb33bcdd5259ba6f47e60e57
6192488729850a7a28498f233346e856b0097e4b3160baa641f8cf9571b56da8
5e446efb6c4f296fb8f25ef7a1a0a482f51dc475bd5ef3e89be9d43782a9f60f
4de4621da1b7da597c2c8def4c08b8d405672dadb9c70d7dffd647c8d6abd394
4d571f4d0008deb01e3144e0e3d5f882c5422acfcb4dd260082852a822d8d2fb
3f41e2ceff3a04cd6de6aadce7e7b7c8584940e4320a7db55dd712debb061510
38f0750cbe49b30db326b53b9f752b66c4f5e23cc3bbbd6d1844e2878a19b9a7
2881194b7e0939d47165c894c891737d8c189ee8fb4720e814a4bcdd804d00d1
2fc2d747847eb04561a435e65954f0103101e2190458eb3c125deda49326c597
21ff399e57cc306a1ae1daab6009ea40c8aa96c39296d0f8781626de6bd19256
170d654b61810992fef6f18dbce5b4c7f5762cf36c9b41c36a14c9f6609f6e7d
1453179d46ef89eb780f8b82632f352017a3586e8d49fc3f087f633f7bebbf0a
9562ad2c173b107a2baa7a4986825b52e881a935deb4356bf8b80b1ec6d41c53
95279881525d4ed4ce25777bb967ab87659e7f72235b76f9530456b48a00bac3
3e65437f910f1f4e93809b81c19942ef74aa250ae228caca0b278fc523ad47c5
Attack Patterns
Warp AV Killer
Qilin
TellYouThePass
Cyclops Blink - S0687
BlackCat - S1068
Play
Noberus
Blacksuit
Akira
ALPHV
Phobos
LockBit
T1548
T1572
T1546
T1505
T1489
T1486
T1083
T1543
T1055
T1498
T1592
T1204
T1053
T1195
T1190
T1059
CVE-2024-4577