Follow the latest coverage, related explainers and connected technology stories.
Research teams have warned of an entity known as Ransom Busters that contacts ransomware attack victims before the attacks are announced and demands up to $60,000 in exchange for decryption keys and deletion of stolen data. Evidence suggests that the entity may be a partner affiliated with the ransomware operations themselves, rather than an independent recovery company.
A partner of the Akira ransomware operation exploited an exposed SonicWall VPN device without multifactor authentication to access the victim’s network, then disabled security tools by rebooting the system into Safe Mode. The attackers successfully stole data and credentials in less than five hours, but the ransomware payload failed to encrypt files because of memory-related errors.