Subj : Microsoft warns US healthcare of threat actor using new ransomwar
To   : All
From : TechnologyDaily
Date : Fri Sep 20 2024 20:15:05

Microsoft warns US healthcare of threat actor using new ransomware

Date:
Fri, 20 Sep 2024 19:02:00 +0000

Description:
Besides BlackCat and Zeppelin, Vanilla Tempest is now using INC, too.

FULL STORY
======================================================================

Vanilla Tempest, a ransomware group also known as Vice Society, has been seen 
deploying the INC ransomware strain for the first time to target the American 
healthcare sector. 

This is according to cybersecurity researchers from Microsoft, who recently 
detailed their newest findings in an X thread. 

In the thread, the company said Vanilla Tempest first receives hands-off from 
Gootloader infections by Storm-0494, before deploying different malware and 
software, including Supper, AnyDesk, MEGA, and others. Vice Society 

The group uses Remote Desktop Protocol (RDP) for lateral movement, and 
Windows Management Instrumentation Provider Host to deploy the INC 
ransomware. 

Unfortunately, Microsoft did not say which organizations Vanilla Tempest 
targeted, or how successful it was. Ransomware attacks against healthcare 
firms usually result in the leak of highly sensitive medical data, as well as 
potentially dizzying payouts. 

Vanilla Tempest, or Vice Society, is a threat actor thats been active since 
mid-2022. It usually targets education, healthcare, IT, and manufacturing 
sectors, and is known for frequently switching between different encryptors . 
While affiliates usually stick to one or two encryptors, Vanilla Tempest was 
observed using BlackCat, Quantum Locker, Zeppelin, Rhysida, and others. 

In October 2022, Microsoft warned about Vanilla Tempest, saying it was known 
for swapping ransomware payloads as it targeted schools in the US. In some 
cases, Microsoft added, the group skips the encryption part altogether and 
just steals the data. 

Some of its victims include the Swedish furniture powerhouse IKEA, as well as 
the Los Angeles Unified School District (LAUSD). IKEA fell prey in late 
November 2022, when its shops in Morocco and Kuwait were forced to shut parts 
of their infrastructure down. A few months earlier, LAUSD tried to negotiate 
with the group to keep the stolen sensitive data private, but the 
negotiations broke down. 

"Unfortunately, as expected, data was recently released by a criminal 
organization, LAUSD said soon after. In partnership with law enforcement, our 
experts are analyzing the full extent of this data release. 

The identity of the hackers is unknown to this day. 

 Via The Hacker News More from TechRadar Pro IKEA confirms it was hit in 
significant cyberattack Here's a list of the best firewalls around today 
These are the best endpoint security tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/microsoft-warns-us-healthcare-of-threat
-actor-using-new-ransomware


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.