Tag Archive for: claimed

Trigona ransomware claimed to be dismantled by Ukrainian hacktivists

/in


BleepingComputer reports that the Trigona ransomware gang had its operations taken down after its servers were compromised and wiped in an attack claimed by the Ukrainian Cyber Alliance hacktivist group.

Exploitation of a critical Confluence Data Center and Server vulnerability, tracked as CVE-2023-22515, enabled UCA hacktivists to infiltrate Trigona’s ransomware infrastructure last week without being detected by the ransomware group. Despite moving to protect its publicly exposed infrastructure following the exposure of its internal support documents by a UCA hacker by the name of “herm1t,” Trigona had hundreds of gigabytes of data from its admin and victim panels, internal systems, blog, and data leak site, as well as its source code, cryptocurrency hot wallets, developer environment, and database records stolen and later deleted by the hacktivists.

Prior to being dismantled, Trigona ransomware compromised Microsoft SQL servers and targeted 15 or more companies across various sectors, including manufacturing and finance.

Source…

Ransomware group claimed to have hit a New Jersey cardiology group. Did they?

/in


On September 2, the NoEscape ransomware group added Mulkay Cardiology Consultants to their leak site and claimed to have successfully encrypted them.

“We have 60GB of confidential and personal data on more than 30,000 patients, scans, doctor’s conclusions about patients and many other confidential information,” they claimed in their listing about the New Jersey medical practice.

Listing on NoEscape claims to have locked and exfiltrated 60 GB of files. Image: DataBreaches.net

DataBreaches checked Mulkay’s website at the time and found nothing amiss and no email address or contact form to use to contact them. DataBreaches reached out to NoEscape via their contact form to request some proof of claims, but received no reply.

On September 19, DataBreaches noticed that NoEscape had added a “DDoS” label to the Mulkay listing and to several other victims’ listings. Attempts to connect to Mulkay’s site returned a 508 error (resource limit reached).

On re-check today, Mulkay’s website is reachable, and there is no alert or notice on it to indicate any breach or issue.

Of note, the Mulkay listing on NoEscape’s leak site could not be found there today. DataBreaches sent an inquiry earlier today to NoEscape asking about its removal but received no reply.

Did Mulkay pay, or was the listing removed because they started to negotiate, or is there some other reason? DataBreaches will continue to try to find out about the alleged attack.

Source…

Largest UK health data breach claimed by ALPHV/BlackCat under investigation – SC Media

/in



Largest UK health data breach claimed by ALPHV/BlackCat under investigation  SC Media

Source…

Georgia city claimed to be attacked by BlackByte ransomware gang

/in



Responsibility for the cyberattack against the City of Augusta, Georgia, which resulted in the disruption of certain city computer systems since May 21, has been admitted by the BlackByte …

Source…