Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Administered by:

Server stats:

8.1K
active users

mastodon.world: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.3

OTX Bot

Threat Actor Profile: Interlock Ransomware

Interlock, a relatively new ransomware group first observed in September 2024, has gained prominence in 2025 as an opportunistic ransomware operator. Unlike traditional Ransomware-as-a-Service models, Interlock operates without affiliates or public advertisements. The group conducts double extortion campaigns, leveraging compromised websites and multi-stage social engineering techniques to deliver payloads. Interlock's attack chain involves initial access through fake software updaters, execution of PowerShell scripts, and the use of custom remote access trojans. The group has targeted various sectors across North America and Europe, including education, healthcare, technology, and government entities. Notable attacks include the DaVita breach in April 2025 and the ransomware attack on the city of St. Paul, Minnesota in July 2025.

Pulse ID: 689f8d13d92fa7802f9dd44a
Pulse Link: otx.alienvault.com/pulse/689f8
Pulse Author: AlienVault
Created: 2025-08-15 19:40:03

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#CyberSecurity#Education#Europe
OTX Bot

Qilin Ransomware and the Hidden Dangers of BYOVD

This analysis examines a recent incident involving Qilin ransomware, highlighting the evolving tactics of cybercriminals to evade Endpoint Detection and Response (EDR) systems. The attackers utilized a previously unknown driver, TPwSav.sys, to disable EDR measures through a technique known as bring-your-own-vulnerable-driver (BYOVD). The report details the entire attack chain, from initial compromise using stolen credentials to the final attempt at deploying ransomware. It emphasizes how rapid isolation of impacted systems and a layered security approach thwarted the attackers. The analysis also provides background on Qilin ransomware, its operation as a ransomware-as-a-service (RaaS), and its targeting patterns. The technical breakdown includes an examination of the EDR bypass technique and the customized version of the EDRSandblast tool used in the attack.

Pulse ID: 688b6bead28aade23c1861a2
Pulse Link: otx.alienvault.com/pulse/688b6
Pulse Author: AlienVault
Created: 2025-07-31 13:13:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#CyberSecurity#EDR#Endpoint
Pyrzout :vm:

Law enforcement operations seized BlackSuit ransomware gang’s darknet sites – Source: securityaffairs.com ciso2ciso.com/law-enforcement- #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #ransomwareasaservice #BlackSuitransomware #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #BreakingNews #SecurityNews #CyberCrime #hacking #Malware #RaaS

law-enforcement-operations-seized-blacksuit-ransomware-gang’s-darknet-sites-–-source:-securityaffairs.com
CISO2CISO.COM & CYBER SECURITY GROUP · Law enforcement operations seized BlackSuit ransomware gang’s darknet sites – Source: securityaffairs.comSource: securityaffairs.com - Author: Pierluigi Paganini An international law enforcement operation seized the dark web data leak site
OTX Bot

Pausing for a "Sanctuary Moon" marathon

This newsletter discusses the debut of the 'Humans of Talos' series, which highlights the people behind Cisco Talos' research and operations. It draws parallels between sci-fi characters and cybersecurity professionals, emphasizing the importance of human creativity and insight in advanced technology. The newsletter also mentions a new ransomware-as-a-service group called Chaos, which is actively targeting organizations worldwide. It provides updates on recent security incidents, including a Microsoft SharePoint vulnerability and a crypto exchange hack. The author stresses the significance of human elements in cybersecurity, despite the increasing use of machine learning.

Pulse ID: 68828d2b128aa99dc887dce2
Pulse Link: otx.alienvault.com/pulse/68828
Pulse Author: AlienVault
Created: 2025-07-24 19:44:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#AWS#Cisco#CryptoExchange
Pyrzout :vm:

Security Pros Say Hunters International RaaS Operators are ‘Changing Jerseys’ – Source: securityboulevard.com ciso2ciso.com/security-pros-sa #SecurityBoulevard(Original) #RansomwareasaService(RaaS) #rssfeedpostgeneratorecho #HuntersInternational #ThreatIntelligence #CyberSecurityNews #SecurityBoulevard #Threats&Breaches #Identity&Access #NetworkSecurity #MobileSecurity #SocialFacebook #SocialLinkedIn

security-pros-say-hunters-international-raas-operators-are-‘changing-jerseys’-–-source:-securityboulevard.com
CISO2CISO.COM & CYBER SECURITY GROUP · Security Pros Say Hunters International RaaS Operators are ‘Changing Jerseys’ – Source: securityboulevard.comSource: securityboulevard.com - Author: Jeffrey Burt The notorious Hunters International RaaS group that racked up hundreds of victims over two years says i
TrendingLive feeds
About
404Not Found