SonicWall SMA devices hacked with OVERSTEP rootkit tied to ransomware
Source: https://www.bleepingcomputer.com/news/security/sonicwall-sma-devices-hacked-with-overstep-rootkit-tied-to-ransomware/
This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.
The June 2025 threat analysis reveals an increase in new ransomware samples compared to May. The data is based on detection names from AhnLab and information collected from Dedicated Leak Sites (DLS) of ransomware groups. Statistics cover the past six months, showing the total number of ransomware samples collected. The analysis includes a breakdown of companies affected by ransomware attacks, as posted on DLS. While some data collection may be incomplete or delayed for certain ransomware groups, the report provides insights into the current ransomware landscape. A list of affected companies publicly disclosed by various ransomware groups is also included, along with MD5 hashes of notable samples.
Secp0 is a ransomware that emerged in early 2025, initially mischaracterized as a vulnerability disclosure extortion group. It operates as a conventional double-extortion ransomware, encrypting data while threatening public disclosure. The malware is an ELF binary targeting Linux systems, using ChaCha20 encryption with ECDH key exchange. It features configurable command-line options and embedded encrypted data. The encryption process involves generating session and file key pairs, calculating shared keys, and appending necessary decryption information to files. The ransomware's structure prevents decryption without the attacker's cooperation, making recovery challenging.
Police disrupt “Diskstation” ransomware gang attacking NAS devices
Source: https://www.bleepingcomputer.com/news/security/police-disrupt-diskstation-ransomware-gang-attacking-nas-devices/
Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously identified JavaScript-based [Interlock RAT](https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/) (aka [NodeSnake](https://www.quorumcyber.com/wp-content/uploads/2025/06/20250416-Higher-Education-Sector-RAT.pdf)), uses PHP and is being used in a widespread campaign.
Athlete or Hacker? Russian basketball player accused in U.S.ransomware case
Source: https://securityaffairs.com/179831/uncategorized/athlete-or-hacker-russian-basketball-player-accused-in-u-s-ransomware-case.html
Pay2Key, an Iranian-backed ransomware-as-a-service operation, has re-emerged as Pay2Key.I2P, targeting Western organizations. Linked to the Fox Kitten APT group and collaborating with Mimic ransomware, the campaign has collected over $4 million in ransom payments in four months. The group offers an 80% profit share to affiliates supporting Iran or attacking its enemies, blending financial motivations with geopolitical objectives. Pay2Key.I2P employs sophisticated evasion techniques, including anti-analysis checks and obfuscation methods. The operation's strategic marketing on darknet forums and social media platforms indicates a planned rollout, with the addition of Linux-targeted ransomware expanding their attack surface.
Ingram Micro starts restoring systems after ransomware attack
Source: https://www.bleepingcomputer.com/news/security/ingram-micro-starts-restoring-systems-after-ransomware-attack/
Iranian group Pay2Key.I2P ramps Up ransomware attacks against Israel and US with incentives for affiliates
Source: https://securityaffairs.com/179754/malware/iranian-group-pay2key-i2p-ramps-up-ransomware-attacks-against-israel-and-us-with-incentives-for-affiliates.html
M&S confirms social engineering led to massive ransomware attack
Source: https://www.bleepingcomputer.com/news/security/mands-confirms-social-engineering-led-to-massive-ransomware-attack/
New Bert Ransomware Group Strikes Globally with Multiple Variants
Source: https://www.infosecurity-magazine.com/news/bert-ransomware-globally-multiple/
SatanLock Ransomware Ends Operations, Says Stolen Data Will Be Leaked
Source: https://hackread.com/satanlock-ransomware-ends-operations-stolen-data-leak/
A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platforms, using PowerShell-based loaders, privilege escalation, and concurrent file encryption. On Linux systems, it can support up to 50 threads for fast encryption and forcibly shut down ESXi virtual machines. The group's tactics include disabling security features, terminating specific processes, and using standard encryption algorithms. BERT's variants have evolved, streamlining their encryption process and expanding their targeting activities. The Linux variant shows similarities to the REvil ransomware, suggesting possible code reuse.
IdeaLab confirms data stolen in ransomware attack last year
Source: https://www.bleepingcomputer.com/news/security/idealab-confirms-data-stolen-in-ransomware-attack-last-year/
