Threats Tagged 'play'

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data breaches, database breaches, and ransomware attacks. A notable case involves the Arkana ransomware group's breach of a global online brokerage firm, In***, resulting in the theft of 50 GB of customer data, including KYC submissions and information of over 163,000 customers. The incident highlights vulnerabilities in trading platforms' identity verification and account protection systems, emphasizing the need for enhanced security measures beyond regulatory compliance.

MediumCampaignSouth KoreaUnited KingdomGermany+3#customer data#ransomware#identity theft

The Play ransomware group has been actively targeting businesses and critical infrastructure across North America, South America, and Europe since June 2022. They gain initial access through exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. The group employs a double extortion model, encrypting systems after data exfiltration. Play ransomware uses AES-RSA hybrid encryption and intermittent encryption techniques. The actors use various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement robust security measures including multifactor authentication, regular patching, network segmentation, and maintaining offline backups to mitigate the risk of ransomware attacks.

MediumMalwareGermanyFranceItaly+7#cve-2022-41082#cve-2018-13379#cve-2020-12812