Update from the Trenches
Ivanti CSA Investigation/Detection Details October 9, 2024 Authors: Rui Ataide, Andrew Nelson, and Hermes Bojaxhi GuidePoint Security has recently been engaged on several incidents related to f…
Archive
Risky Recovery: Ransomware “Decryption” Scams Remain in 2024
September 19, 2024 Note: To protect the identity of the individuals involved in these events, some details of the ransomware attack and recovery company have been altered.
GRIT Ransomware Report: August 2024
September 12, 2024 Additional contributors to this report: Jason Baker, Ryan Silver, JP Mouton, and Grayson North In this month’s report, we highlight the Ransomware group, Black Suit, the only rans…
Hazard Ransomware – A Successful Broken Encryptor Story
September 10, 2024 Ransomware encryption can be one of the most devastating security events for an organization, potentially halting operations and causing significant financial and emotional stress.
So-Phish-ticated Attacks
Update: September 16, 2024 Authors: Rui Ataide, Hermes Bojaxhi GuidePoint Security is continuing to monitor this ongoing campaign.
GRIT Ransomware Report: July 2024
August 15, 2024 Additional contributors to this report: Jason Baker, Justin Timothy, Ryan Silver, and JP Mouton July 2024 yielded some answers to our ongoing questions about the future of ransomware, …
GRIT Ransomware Report: May 2024
June 13, 2024 Additional contributors to this report: Grayson North, Jason Baker May 2024 closed with an increase in overall victim volume, though deep review reveals that the increase was driven disp…
GRIT Ransomware Report: April 2024
May 16, 2024 Additional contributors to this report: Nic Finn, Grayson North, Justin Timothy April 2024 presented as an outlier amidst the preceding two years of reporting, with notable impacts on ran…
Awkward Adolescence: Increased Risks Among Immature Ransomware Operators
April 11, 2024 Summary.
T-O-X-I-N-B-I-O – Ransomware Recruitment Efforts Following Law Enforcement Disruption
March 20, 2024 Contributors: Jason Baker, Senior Threat Intelligence Consultant; Drew Schmitt, Practice Lead, GRIT This blog expands on observations made as part of GRIT’s February 2024 Ransomware R…
GRIT Ransomware Report: February 2024
March 14, 2024 Additional contributors to this report: Nic Finn, Jason Baker, Justin Timothy, Ryan Silver February 2024 was an utterly chaotic month in the ransomware space.
BianLian GOs for PowerShell After TeamCity Exploitation
March 8, 2024 Contributors: Justin Timothy, Threat Intelligence Consultant, Gabe Renfro, DFIR Advisory Consultant, Keven Murphy, DFIR Principal Consultant Introduction Ever since Avast released a decr…