Ransomware hits 300 victims, FBI notes critical orgs in crossfire

December 18, 2023
1 min read
  • The FBI reports that the Play ransomware gang has breached approximately 300 organizations, including critical infrastructure entities, globally between June 2022 and October 2023.
  • A joint advisory warning has been issued in partnership with the Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
  • High-profile victims of Play ransomware include the City of Oakland in California, car retailer Arnold Clark, cloud computing firm Rackspace, and the Belgian city of Antwerp.
  • The authorities advise organizations to prioritize addressing known vulnerabilities, implement multifactor authentication (MFA) across all services and regularly update and patch software and applications.

Play ransomware surfaced in June 2022, causing significant impacts to businesses and critical infrastructure in North America, South America, and Europe. Unlike typical ransomware operations, the Play ransomware affiliates use email communication for negotiations, rather than providing Tor negotiations page link in ransom notes left on compromised systems. However, the gang still employs strategies commonly associated with ransomware, such as stealing sensitive documents from compromised systems to pressure victims into paying ransom demands under the threat of leaking the stolen data online.

According to the joint advisory issued by the FBI, CISA, and ASD’s ACSC, organizations are urged to cover their vulnerabilities that have been previously exploited to diminish the likelihood of falling a victim to Play ransomware attacks. Entities are advised to focus particularly on implementing MFA for webmail, VPN, and accounts with access to critical systems. The advisory also presses on the importance of regular updates and patches, alongside routine vulnerability assessments.

High-profile victims of the ransomware attacks include the likes of the City of Oakland (California), car retailer Arnold Clark, cloud computing company Rackspace, and the Belgian city of Antwerp. The Play gang also uses a custom VSS Copying Tool to aid in stealing files from shadow volume copies, even when the files are being used by applications.

In conclusion, the three government agencies encourage organizations to take heed of their advisory’s recommendations, which include maintaining offline backups of data, applying a recovery plan, and always keeping all operating systems, software, and firmware up-to-date.

Latest from Blog

Top 3 Cybersecurity Stocks for May 2024 Buy Now

TLDR: Key Points: Cybersecurity stocks are using AI to enhance their platforms Top cybersecurity stocks to buy now include Crowdstrike, Fortinet, and Palo Alto Networks Article Summary: The cybersecurity market is booming

Get Secure: Know the Basics of Cloud Security Fundamentals Now

TLDR: Cloud security fundamentals are essential for data protection, regulatory compliance, and access management in a cloud environment. Key fundamentals include identifying assets, implementing security controls, conducting risk assessments, managing user access