Oleg Skulkin's new book 'Incident Response Techniques for Ransomware Attacks' reached number 7 in Top 100 Amazon Best Sellers in Viruses & Malware!

In his book the Head of Digital Forensics and Malware Analysis Lab at Group-IB goes into the history of ransomware and provides the skills you need to build an incident response strategy for all ransomware attacks.

Crypto scammers cashing in on Johnny Depp-Amber Heard trial.

Remember Group-IB’s report about crypto scammers who made $1.6 mil on fake YouTube streams? The scammers ran 36 fabricated cryptocurrency giveaway YouTube streams that attracted more than 165,000 viewers.

Well, they are back now. Having updated some tactics they are now trying to capitalise on the Johnny Depp-Amber Heard’s live court case.

Using a fake YouTube channel called "Johnny Depp" broadcasting the trial (viewed by 17K), crypto scammers are driving traffic to their rogue website. They demonstrate a QR code above the stream prompting the users to double their cryptocurrency. The QR code leads to a scam website musktesla2022[.]com with instructions on how to "get rich". The scammers use the name of Elon Musk and the logo of Tesla as baits.

Stay vigilant!

You can read more about how the scheme works here👈

#scam #crypto

Lockbit, Conti, and Pysa turned out to be the most aggressive ransomware gangs, according to Group-IB's second annual guide to the evolution of threat number one “Ransomware Uncovered 2021/2022”.

Our experts analysed more than 700 attacks investigated as part of Group-IB’s own incident response engagements and cyber threat intelligence activity in 2021 and also examined ransomware DLS.

Here are some highlights from the report:

▪️The average ransom demand grew by 45% to reach $247,000 in 2021;

▪️The victim’s downtime increased from 18 days in 2020 to 22 days in 2021;

▪️A record-breaking ransom of $240 million ($30 mln in 2020) was demanded by Hive from MediaMarkt;

▪️Between the Q1’2021 and Q1’2022, ransomware gangs posted data belonging to more than 3,500 victims on DLS;

▪️Most companies whose data was posted on DLS by ransomware operators in 2021 were based in the US, Canada, and the UK.

Click here to download the new report 👈

#ransomware #research

Аccording to Group-IB's report "Ransomware Uncovered 2021/2022", exploitation of public-facing RDP servers once again became the most common way to gain an initial foothold in the target network in 2021.

47% of all the attacks investigated by Group-IB DFIR experts started with compromising an external remote service. Spear phishing emails carrying commodity malware on board remained second (26%).

In general, many ransomware affiliates relied on living-off-the-land techniques and legitimate tools during the attack lifecycle. Commodity malware was often used to start post-exploitation activities via loading frameworks such as Cobalt Strike (observed in 57% of the attacks).

However, some ransomware gangs were seen trying very unconventional approaches. Want to learn more? Check out our new report👈