The Week in Ransomware – January 26th, 2024: Governments Take Action

In a week marked by governmental responses to ransomware threats, sanctions were imposed on one threat actor, while another was sentenced to prison.

Government Sanctions on REvil Member: On Tuesday, the Australian, US, and UK governments jointly announced sanctions against Aleksandr Gennadievich Ermakov, a Russian national linked to the REvil ransomware group. Ermakov is believed to be behind the 2022 Medibank hack, as per Intel471. His involvement in cybercrime, including ransomware operations and affiliation with REvil, was highlighted. Ermakov is also suspected to be engaged in both legal and criminal software development.

US Sentences TrickBot Malware Developer: On Thursday, Russian national Vladimir Dunaev received a prison sentence of five years and four months in the US for his role in creating and disseminating the TrickBot malware. Dunaev was a Trickbot Group malware developer, overseeing the creation of codes used for internet browser injection, machine identification, and data harvesting. The malware was employed in attacks on hospitals, schools, and businesses in the USA.

Notable Cyberattacks: Several significant cyberattacks were reported during the week, including an Akira ransomware attack on Tietoevry, a Veolia North America ransomware incident, and an attack on EquiLend, claimed by LockBit. loanDepot revealed that its January 6th ransomware attack exposed the data of 16.6 million individuals.

Ransomware Groups and Variants: Researchers linked the 3AM ransomware operation to notorious groups like Conti and Royal. New variants such as FAUST and LockXX were identified, while PCrisk discovered fresh Phobos and STOP ransomware variants appending unique extensions.

Threat Assessment: BianLian: Researchers tracked the activities of the BianLian ransomware group, observing its impact on the healthcare and manufacturing sectors in the US and Europe.

AI Impact on Ransomware Threat: The UK’s National Cyber Security Centre (NCSC) warned of the adverse impact of artificial intelligence (AI) tools on cybersecurity, escalating the ransomware threat in the near term.

Governments’ proactive measures against ransomware actors reflect a growing global effort to combat cyber threats. The week also witnessed ongoing cyber incidents and the emergence of new ransomware variants, emphasizing the persistent challenges faced by organizations worldwide.

Stay updated with supply chain news at The Supply Chain Report. Learn more about international trade at ADAMftd.com with free tools.

#GovCyberSanctions #RansomwareThreat #REvilSanction #TrickBotSentencing #CybersecurityUpdate #ThreatActorAlert #AIandCyberRisk #RansomwareNews #CyberIncidentReport #GlobalCyberResponse #MedibankHack #USCyberSecurity