Tag Archive for: Corp

Evil Corp Switches to Ransomware-as-a-Service to Evade US Sanctions

/in


Evil Corp—or at least a hacking group affiliated with it—is mixing things up.

Mandiant reports(Opens in a new window) that a threat actor it’s been tracking as UNC2165 appears to be related to the cybercrime group, which was sanctioned(Opens in a new window) by the US Treasury Department in 2019 for using “the Dridex malware to infect computers and harvest login credentials from hundreds of banks and financial institutions in over 40 countries, causing more than $100 million in theft.”

Those sanctions prevent organizations from paying a ransom to restore access to their systems. Financially motivated threat actors like Evil Corp aren’t targeting organizations for the fun of it, or looking to further a nation-state’s agenda, so they have to maximize their chances of getting paid. That means they need to make it harder for their victims to identify them.

A timeline of ransomware strains used by groups affiliated with Evil Corp

Which is why Mandiant says that hacking groups affiliated with Evil Corp have used a variety of ransomware strains over the last two years. The groups initially used WastedLocker(Opens in a new window), but after that ransomware’s connection to Evil Corp was revealed, they switched to a ransomware family known as Hades(Opens in a new window). Now they’ve started using a ransomware-as-a-service (RaaS) called Lockbit.

Mandiant says that using a RaaS offering makes sense for groups affiliated with Evil Corp:

Recommended by Our Editors

Both the prominence of LOCKBIT in recent years and its successful use by several different threat clusters likely made the ransomware an attractive choice. Using this RaaS would allow UNC2165 to blend in with other affiliates, requiring visibility into earlier stages of the attack lifecycle to properly attribute the activity, compared to prior operations that may have been attributable based on the use of an exclusive ransomware. Additionally, the frequent code updates and rebranding of HADES required development resources and it is plausible that UNC2165 saw the use of LOCKBIT as a more cost-effective choice.

The company says it expects similar groups “to take steps such as these to obscure their identities in order to ensure that it is not a limiting factor to receiving payments from victims.”…

Source…

Russian hacking gang Evil Corp shifts its extortion strategy after sanctions

/in


A back-lit computer keyboard.

A back-lit computer keyboard. (Chris Ratcliffe/Bloomberg)

A notorious Russian cybercrime group has updated its attack methods in response to sanctions that prohibit U.S. companies from paying it a ransom, according to cybersecurity researchers.

The security firm Mandiant said Thursday it believes that the Evil Corp gang is now using a well-known ransomware tool named Lockbit. Evil Corp has shifted to using Lockbit, a form of ransomware used by numerous cybercrime groups, rather than its own brand of malicious software to hide evidence of the gang’s involvement so that compromised organizations are more likely to pay an extortion fee, researchers said.

The U.S. Treasury Department in 2019 sanctioned the alleged leaders of the Evil Corp gang, creating legal liabilities for American companies that knowingly send ransom funds to the hackers. While cybersecurity firms have associated Evil Corp with two kinds of malware strains, known as Dridex and Hades, the group’s use of LockBit could cause hacked organizations to believe that another hacking group, other than Evil Corp, was behind the breach.

Evil Corp is believed to be behind some of the worst banking fraud and computer hacking schemes of the past decade, stealing more than $100 million from companies across 40 countries, according to the U.S. government.

Alleged members are on the wanted lists of law enforcement across the U.S., UK and Europe, including accused mastermind Maksim Yakubets, who the Treasury Department said previously worked for Russia’s Federal Security Service. The 35-year-old Russian man is reported to own a tiger and drive a personalized Lamborghini with a license plate that translates to say “thief,” according to the U.K.’s National Crime Agency.

The U.S. has increasingly used sanctions to try to curb cybercriminal operations, including prohibiting American organizations from paying ransom fees to known groups like Evil Corp and cryptocurrency exchanges which are often used to funnel ransom payments.

…

Source…

CERBERUS CYBER SENTINEL CORP MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS (form 10-Q)

/in


The following Management’s Discussion and Analysis of Financial Condition and
Results of Operations should be read in conjunction with our condensed financial
statements and related notes.

Unless otherwise indicated or the context requires otherwise, the terms “we,”
“us,” “our,” and “our company” refer to Cerberus Cyber Sentinel Corporation, a
Delaware corporation (“Cerberus”), and its wholly owned subsidiaries, including
GenResults, LLC, an Arizona limited liability company (“GenResults”), TalaTek,
LLC, a Virginia limited liability company (“TalaTek”), Technologyville, Inc., an
Illinois corporation (“Techville”), Clear Skies Security, LLC, a Georgia limited
liability company (“Clear Skies”), Alpine Security, LLC, an Illinois limited
liability company (“Alpine”), Catapult Acquisition Corporation, a New Jersey
corporation (“VelocIT”), Southford Equities, Inc., a British Virgin Islands
company (“Arkavia”), True Digital Security, Inc., a Delaware corporation (“True
Digital”), RED74 LLC, a New Jersey limited liability company (“RED74”), Atlantic
Technology Systems, Inc., a New Jersey corporation (“ATS”), and Atlantic
Technology Enterprises, Inc., a New Jersey corporation (“ATE” and together with
ATS, “Atlantic”). Unless otherwise specified, all dollar amounts are expressed
in United States dollars.



Our Business

We are a cybersecurity and compliance company comprised of highly trained and
seasoned security professionals who work with clients to enhance or create a
better cyber posture in their organization. Cybersecurity, also known as
computer security or information technology security, is the protection of
computer systems and networks from information disclosure, theft of or damage to
their hardware, software, or electronic data, as well as from the disruption or
misdirection of the services they provide. The cybersecurity industry has a
supply and demand issue wherein there is more demand for cybersecurity services
than there are expert and seasoned compliance and cybersecurity professionals
available in the market. We seek to identify, attract, and retain highly skilled
cyber and compliance teams and bring them together to provide holistic cyber
services. We accomplish…

Source…

Jamf Holding Corp. (JAMF) CEO Dean Hager on Q1 2022 Results – Earnings Call Transcript

/in


Jamf Holding Corp. (NASDAQ:JAMF) Q1 2022 Earnings Conference Call May 10, 2022 4:30 PM ET

Company Participants

Dean Hager – Chief Executive Officer

John Strosahl – President & Chief Operating Officer

Jill Putman – Chief Financial Officer

Jennifer Gaumond – Vice President, Investor Relations

Conference Call Participants

Brian Essex – Goldman Sachs

Rob Owens – Piper Sandler

Matt Stotler – William Blair

Joshua Reilly – Needham

Nick Mattiacci – Craig-Hallum

Vinod Srinivasaraghavan – Barclays

Joey Marincek – JMP Securities

Operator

Thank you for standing by and welcome to the First Quarter 2022 Jamf Earnings Conference Call. [Operator Instructions] As a reminder, today’s program is being recorded. And now I’d like to introduce your host for today’s program, Jennifer Gaumond, Vice President, Investor Relations. Please go ahead.

Jennifer Gaumond

Good afternoon and thank you for joining us on today’s conference call to discuss Jamf’s first quarter financial results. WIth me on today’s call are Dean Hager, Chief Executive Officer, Jill Putman, Chief Financial Officer, and John Strosahl, President and Chief Operating Officer. Before we begin, I’d like to remind you that shortly after the market closed today, we issued a press release announcing our first-quarter financial results. We also published a Q1 earnings presentation and updated investor presentation and Excel file containing quarterly financial statements to assist with models. You may access this information on the Investor Relations Section of Jamf.com. Today’s discussion may include forward-looking statements. Please refer to our most recent SEC filings, including our most recent annual report on Form 10-K, where you will see a discussion of factors that could cause actual results to differ materially from these statements. I would also like to remind you that during the call, we will discuss some non-GAAP measures related to Jamf’s performance. You can find the reconciliation of those measures to the nearest comparable GAAP measures in our SEC filings and press release. Additionally, to ensure we can address as many analyst questions as possible during the call, we ask that you please limit your…

Source…