The LockBit ransomware group, a prolific ransomware as a service (RaaS) operator, claimed responsibility for a breach of the cybersecurity company Entrust discovered on 18 June. LockBit created a data leak page for Entrust on their website on 18 August, threatening to release the stolen information if Entrust would not pay the ransom. Shortly after, the LockBit blog started getting hit by distributed denial-of-service (DDoS) attacks, as reported by Azim Shukuhi, a cybersecurity researcher. According to LockBit, these incoming requests referenced Entrust, leading them to the belief that these attacks happened due to their breach of the software company. Notably, LockBit infrastructure has already suffered setbacks in the past. In the aftermath of the Accenture breach, the download site where leak was published has quickly became unavailable, likely due to combination of poor infrastructure architecture and significant volume of traffic related to attempts of download of the files. As a result, the actual download of stolen materials was only possible during sample windows of stability of the site.

Rollups

Industries impacted: Communication Services, Consumer Discretionary, Consumer Staples, Energy, Financials, Government, Health Care, Industrials, Information Technology, Materials, Real Estate, Utilities

• Group-IB researchers uncover APT41 activity throughout 2021
• Celer Network Shuts Down Bridge Over DNS Hijacking
• Russian APT29 AbuseS Azure Services to Compromise Microsoft 365 Users
• Grandoreiro Malware With New Capabilities Targets Spain And Mexico
• Greek Gas System Operator DESFA Confirms Cyberattack Attackers Exploit Zero-Day Bug In Bitcoin ATMs
• Researchers Identify and Remove Over 200 Malicious NPM and PyPI Packages
• Brute Ratel: The New Red Teaming Tool Coopted by CTAs
• Exploitable Hikvision Cameras Accessible On The Internet

Geo Highlights

EU At a Crossroads Amid Internal and External Challenges

Industry impacted: Government