Some involve different kinds of malware, or double – even triple – infections of the same type. Some attacks take place simultaneously others are separated by a few days, weeks, or months. In an issue we highlighted in our Active Adversary Playbook 2022, we’re seeing organizations being hit by multiple attackers. Some of the incidents Sophos recently investigated may force the industry to consider changing this rule-of-thumb: The question is not if, or when – but how many times? There’s a well-worn industry phrase about the probability of a cyberattack: “It’s not a matter of if, but when.” 'The question is not if, or when – but how many times?' Read more detail from Linda Smith, Rajat Wason, and Syed Zaidi: #cybersecurity #infosec #ransomware #cyberattack #security Sophos’ Rapid Response (RR) team investigated, and found several files which had been encrypted multiple times – as many as five in some instances. Two weeks after the Lockbit and Hive attacks, the threat actor distributed their ransomware, and cleared Windows Event Logs. The second group, identified as Hive, used RDP to move laterally, before dropping their ransomware just two hours after the Lockbit threat actor.Īs the victim restored data from backups, an ALPHV/BlackCat affiliate accessed the network, installed Atera Agent (a legitimate remote access tool) to establish persistence, and exfiltrated data. The first ransomware group, identified as Lockbit, exfiltrated data to the Mega cloud storage service, used Mimikatz to extract passwords, and distributed their ransomware binary using PsExec. All three threat actors abused the same misconfiguration – a firewall rule exposing Remote Desktop Protocol (RDP) on a management server – but used different ransomware strains and tactics. In May 2022, an automotive supplier was hit with three separate ransomware attacks. In the latest from Sophos X-Ops, our team investigated an incident where three separate ransomware actors used the SAME point of entry to attack a single organization.

Sophos endpoint protection standard