YouTube video by Mikasacus

difficult to detect and more modular read more about FIN7 FIN8 and Others Use Ragnar Loader for Persistent Access and Ransomware Operations

YouTube video by Richard Scott

YouTube video by Tim Borg

Ragnar Loader malware enables ransomware groups to maintain stealthy access, evade detection, and execute remote control operations.

FIN8, known for targeting PoS systems, is now using Sardonic backdoor to deploy BlackCat ransomware

Ragnar Loader malware enables ransomware groups to maintain stealthy access, evade detection, and execute remote control operations.

Il y a quatre films à voir au cinéma en ce mois de Juillet. Quatre moments au frais et peut être du bon temps à passer.   The Fin8 juillet 2026 en salle De

Threat hunters have shed light on a "sophisticated and evolving malware toolkit" called Ragnar Loader that's used by various cybercrime and ransomware groups like Ragnar Locker (aka Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis (ex-REvil). "Ragnar Loader plays a key role in keeping access to compromised systems, helping attackers stay in networks for long-term operations," Swiss

Ragnar Loader malware enables ransomware groups to maintain stealthy access, evade detection, and execute remote control operations.

Citrix issued a patch for the critical remote code execution bug in July for its NetScaler devices.

Financially motivated actor linked to the FIN8 group exploits the CVE-2023-3519 RCE in attacks on Citrix NetScaler systems in massive attacks

A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.

<div><p>Organised crime groups like Fin8 still use old school methods like spear-phishing, because the human factor is the hardest to secure.</p><p><a href="https://medium.com/@nathan.harrison1835/fin8-spear-phishing-7938562dcb27?source=rss------cybersecurity-5">Continue reading on Medium »</a></p></div>

The cybercrime group has given its backdoor malware a facelift in an attempt to evade detection, making some bug fixes and setting itself up to deliver its latest crimeware toy, BlackCat.

<p><img src="https://www.bleepstatic.com/content/hl-images/2022/05/12/evil-hacker-ai.jpg" alt="evil-hacker-ai.jpg"></p>A financially motivated cybercrime gang has been observed deploying BlackCat ransomware payloads on networks backdoored using a revamped Sardonic malware version. [...]

<p><img src="https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEh7azNv2ZIGlPZJGXddwDYXc09nptlqiOMPA5gLEetre2biyGC7pvnHuyb5rOg0rctz88hWpe197HwJTaWLVoM0rFxbvsILFzdB0Q9TaCi_DAM3ChVMUXSN9MVIE1IGjcbfUL5ZkDhWzhs3Ozqoy-24Xlw_25xqutgj5FTgo8B54W1THnI2kgzWzZeasIK4/s728-e3650/ransomware.jpg" alt="ransomware.jpg"></p>The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware. According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to diversify its focus and maximize profits from infected entities. The intrusion attempt took place in

<p><img src="https://cyberscoop.com/wp-content/uploads/sites/3/2023/07/GettyImages-515366502.jpg" alt="GettyImages-515366502.jpg"></p><p>A financially motived cybercrime group has updated its bespoke backdoor malware in a continued attempt to deploy ransomware against targets around the world, researchers said Tuesday. </p> <p>Security researchers recently observed Syssphinx, which is also tracked widely as <a href="https://cyberscoop.com/tag/fin8/">FIN8</a> since its emergence in 2016, deploying a variant of its <a href="https://www.bitdefender.com/blog/labs/fin8-threat-actor-spotted-once-again-with-new-sardonic-backdoor/">Sardonic backdoor</a> to deliver Noberus ransomware but altered in a way to obfuscate its origins.</p> <p>“Most of the backdoor’s code has been rewritten, such that it gains a new appearance,” researchers with the Symantec Threat Hunter Team, part of Broadcom, <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/Syssphinx-FIN8-backdoor">said in a report published Tuesday</a>. “Some of the reworking looks unnatural, suggesting that the primary goal of the threat actors could be to avoid similarities with previously disclosed details.”</p> <p>Syssphinx is known for attacking hospitality, retail, entertainment, insurance, technology, chemicals and finance organizations. The group started out with malware specialized for point-of-sale attacks to steal credit card details, but in the past few years it has evolved to deploy other groups’ ransomware variants in its attempts to swindle victims, researchers said. </p> <p>In June 2021, for instance, researchers detected the group deploying<a href="https://www.cybereason.com/blog/threat-analysis-report-ragnar-locker-ransomware-targeting-the-energy-sector"> Ragnar Locker</a> ransomware onto compromised machines in a U.S. financial services company. Six months later the group <a href="https://www.bleepingcomputer.com/news/security/new-white-rabbit-ransomware-linked-to-fin8-hacking-group/#google_vignette">deployed</a> its own ransomware variant, <a href="https://twitter.com/demonslay335/status/1470823608725475334?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1470823608725475334%7Ctwgr%5E7f867a01fdfc778ad3d7b2210c98b45c6247eefa%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fnew-white-rabbit-ransomware-linked-to-fin8-hacking-group%2F">dubbed “White Rabbit”</a> based on the ransom note delivered, in an attack on a U.S. bank. And more recently, in December 2022, the group deployed Noberus, which emanates from the <a href="https://www.cisecurity.org/insights/blog/breaking-down-the-blackcat-ransomware-operation">well-known</a> BlackCat/AlphaV group.</p> <p>“The Syssphinx group’s move to ransomware suggests the threat actors may be diversifying their focus in an effort to maximize profits from compromised organizations,” the Symantec researchers wrote. </p> <p>The group is also known for taking extended breaks from public activity to refine its tactics, techniques and procedures, the researchers said. Nevertheless, given its consistent run from at least 2016 (maybe earlier), the group remains a potent threat.</p> <p>“Syssphinx continues to develop and improve its capabilities and malware delivery infrastructure, periodically refining its tools and tactics to avoid detection,” the researchers said. “The group’s decision to expand from point-of-sale attacks to the deployment of ransomware demonstrates the threat actors’ dedication to maximizing profits from victim organizations. The tools and tactics detailed in this report serve to underscore how this highly skilled financial threat actor remains a serious threat to organizations.”</p> <p>The post <a href="https://cyberscoop.com/syssphinx-cybercrime-ransomware/">Financial cybercrime syndicate deploys reworked backdoor malware</a> appeared first on <a href="https://cyberscoop.com">CyberScoop</a>.</p>

Ragnar Loader, a sophisticated malware toolkit, is primarily associated with ransomware groups such as FIN7, FIN8, and Ragnar Locker. It has evolved significantly since its emergence in 2020, integrat...

Ragnar Loader, a sophisticated malware toolkit, is primarily associated with ransomware groups such as FIN7, FIN8, and Ragnar Locker. It has evolved significantly since its emergence in 2020, integrat...