ransomware Archives - Microsoft Security Blog

Microsoft Security

Microsoft Security

Sign in

a man standing in front of a computer

November 17, 2022 • 7 min read

DEV-0569 finds new ways to deliver Royal ransomware, various payloads

DEV-0569’s recent activity shows their reliance on malvertising and phishing in delivering malicious payloads. The group’s changes and updates in delivery and payload led to distribution of info stealers and Royal ransomware.

a view of a city at night

November 3, 2022 • 6 min read

Stopping C2 communications in human-operated ransomware through network protection

Providing advanced protection against increasingly sophisticated human-operated ransomware, Microsoft Defender for Endpoint’s network protection leverages threat intelligence and machine learning to block command-and-control (C2) communications.

A person sitting at a desk in front of a laptop computer

October 27, 2022 • 15 min read

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft has discovered recent activity indicating that the Raspberry Robin worm is part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread.

October 25, 2022 • 10 min read

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society.

Practitioner and CISO collaboration in a security war room.

October 18, 2022 • 13 min read

Defenders beware: A case for post-ransomware investigations

The Microsoft Detection and Response Team (DART) details a recent ransomware incident in which the attacker used a collection of commodity tools and techniques, such as using living-off-the-land binaries, to launch their malicious code.

Data center illuminated with a bluish light. Yellow cords running on the servers are prominently displayed.

October 14, 2022 • 8 min read

New “Prestige” ransomware impacts organizations in Ukraine and Poland

The Microsoft Threat Intelligence Center (MSTIC) has identified evidence of a novel ransomware campaign attributed to IRIDIUM targeting organizations in the logistics and transportation industry in Ukraine and Poland utilizing a previously unidentified ransomware payload.

Security practitioner working in to investigate threats.

September 7, 2022 • 11 min read

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

Microsoft threat intelligence teams have been tracking multiple ransomware campaigns tied to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS.

Top-down view of a bearded man in a gray/blue shirt seated at a desk working on a Surface laptop connected to three large monitors.

August 24, 2022 • 10 min read

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks

Threat actors evade detection by adopting the Sliver command-and-control (C2) framework in intrusion campaigns.

July 14, 2022 • 13 min read

North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware

A group of actors originating from North Korea that MSTIC tracks as DEV-0530 has been developing and using ransomware in attacks since June 2021. This group, which calls itself H0lyGh0st, utilizes a ransomware payload with the same name.

Photo of rusty metal materials

July 5, 2022 • 16 min read

Hive ransomware gets upgrades in Rust

With its latest variant carrying several major upgrades, Hive proves it’s one of the fastest evolving ransomware payload, exemplifying the continuously changing ransomware ecosystem.

1
2
3
…
10
Next Page