← Feed

Posts

• Post #4496258

  𝐒𝐢𝐧𝐠𝐢𝐧𝐠 𝐑𝐢𝐯𝐞𝐫 𝐇𝐞𝐚𝐥𝐭𝐡 𝐒𝐲𝐬𝐭𝐞𝐦: 𝐁𝐞𝐭𝐰𝐞𝐞𝐧 𝐑𝐚𝐧𝐬𝐨𝐦𝐰𝐚𝐫𝐞, 𝐋𝐞𝐠𝐚𝐥 𝐃𝐢𝐬𝐩𝐮𝐭𝐞𝐬, 𝐚𝐧𝐝 𝐑𝐞𝐜𝐮𝐫𝐫𝐢𝐧𝐠 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬 Just over two years after the devastating ransomware attack attributed to the Rhysida group, Singing River Health System (SRHS) has once again fallen victim to cybercrime. This time, the Anubis ransomware group has claimed responsibility for compromising the healthcare organization’s IT systems, stating that it stole sensitive data belonging to patients and employees before encrypting the infrastructu...

• Post #4496257

  𝐄𝐯𝐞𝐫𝐞𝐬𝐭: 𝐒𝐢𝐱 𝐘𝐞𝐚𝐫𝐬 𝐨𝐟 𝐄𝐯𝐨𝐥𝐮𝐭𝐢𝐨𝐧 𝐟𝐫𝐨𝐦 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤 𝐭𝐨 𝐃𝐨𝐮𝐛𝐥𝐞 𝐄𝐱𝐭𝐨𝐫𝐭𝐢𝐨𝐧 – 𝐭𝐡𝐞 𝐢𝐧𝐭𝐞𝐫𝐯𝐢𝐞𝐰 The responses provided to SuspectFile paint a picture of a group that claims to have grown gradually and demonstrated a consistent ability to adapt. One of the most interesting aspects concerns the shift from extortion based solely on stolen data to the adoption of encryption. https://www.suspectfile.com/everest-six-years-of-evolution-from-data-leak-to-double-extortion-the-interview/ #ALPHV #Black_Basta #Doubl...

• Post #4496256

  @verisizintisi @PogoWasRight @jerry @JayeLTee Hi, I read your article on HCRG and I think you may be mistaken about some of your writing. In one passage, you write, "The entity directly affected by the attack is CRG Medical Services, a subsidiary of HCRG that provides forensic medical services to police forces." Can I ask where you got this information? Has it been verified by you? If it has been verified, can you provide evidence? I think, I'm sure, you're mis...

• Post #4496255

  𝗡𝗼𝘃𝗮 𝗖𝗹𝗮𝗶𝗺𝘀 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝗡𝗦𝗪 𝗦𝘆𝘀𝘁𝗲𝗺𝘀: 𝗕𝗲𝘁𝘄𝗲𝗲𝗻 𝟰𝟬𝟬 𝗚𝗕 𝗘𝘅𝗳𝗶𝗹𝘁𝗿𝗮𝘁𝗲𝗱 𝗮𝗻𝗱 𝗗𝗮𝘁𝗮 𝗗𝗶𝘀𝗽𝘂𝘁𝗲𝗱 𝗯𝘆 𝗔𝘂𝘁𝗵𝗼𝗿𝗶𝘁𝗶𝗲𝘀 The story emerged in recent days via the 𝐍𝐨𝐯𝐚 𝐠𝐫𝐨𝐮𝐩’𝐬 𝐝𝐚𝐭𝐚 𝐥𝐞𝐚𝐤 𝐩𝐨𝐫𝐭𝐚𝐥, where the ransomware operators 𝗹𝗶𝘀𝘁𝗲𝗱 𝘁𝗵𝗲 𝗡𝗲𝘄 𝗦𝗼𝘂𝘁𝗵 𝗪𝗮𝗹𝗲𝘀 𝗴𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 among their alleged victims, claiming to have gained access to a hashtag #Citrix system and exfiltrated a significant amount of data. https://www.suspectfile.com/nova-claims-access-to-nsw-systems-between-400-gb-exfiltrated-and-data-disputed-by-authorities/ #Cit...

• Post #4496254

  𝗚𝗹𝗼𝗯𝗮𝗹 𝗦𝗰𝗵𝗼𝗼𝗹𝘀 𝗚𝗿𝗼𝘂𝗽 𝗮𝗻𝗱 𝗙𝘂𝗹𝗰𝗿𝘂𝗺𝗦𝗲𝗰: 𝗔 𝗠𝗮𝘀𝘀𝗶𝘃𝗲 𝗗𝗮𝘁𝗮 𝗕𝗿𝗲𝗮𝗰𝗵 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗪𝗼𝗿𝗹𝗱𝘄𝗶𝗱𝗲 𝗣𝘂𝘀𝗵 𝘁𝗼 𝗦𝘂𝗽𝗽𝗿𝗲𝘀𝘀 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗼𝗻 𝗜𝘁 Among the statements attributed to FulcrumSec are allegations of particularly poor security practices. The group claims to have identified administrative credentials reused across numerous systems, passwords stored in plaintext, #AWS access keys embedded directly within application code, and databases relying on credentials that had reportedly remained unchanged for years. https://www....

• Post #4496253

  𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁𝘀: 𝗪𝗵𝗲𝗻 𝘁𝗵𝗲 𝗣𝗿𝗼𝗯𝗹𝗲𝗺 𝗜𝘀 𝗡𝗼𝘁 𝗢𝗻𝗹𝘆 𝗪𝗵𝗼 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 In this context, attackers’ ability to exploit existing vulnerabilities is intertwined with a less discussed but equally crucial reality: the accumulation of technical and organizational weaknesses that often remains unresolved until data exfiltration occurs. https://www.suspectfile.com/cybersecurity-incidents-when-the-problem-is-not-only-who-attacks/ #Cybersecurity #Data_Breaches #Data_Protection #Digital_Privacy #Ransomware

• Post #4496252

  𝗚𝗹𝗼𝗯𝗮𝗹 𝗦𝗰𝗵𝗼𝗼𝗹𝘀 𝗚𝗿𝗼𝘂𝗽, 𝗿𝗲𝗻𝗲𝘄𝗲𝗱 𝗽𝗿𝗲𝘀𝘀𝘂𝗿𝗲 𝗼𝗻 𝗗𝗮𝘁𝗮𝗕𝗿𝗲𝗮𝗰𝗵𝗲𝘀: 𝘁𝗵𝗲 𝗨𝗦 𝘀𝗶𝘁𝗲 𝗿𝗲𝗷𝗲𝗰𝘁𝘀 𝗮𝘁𝘁𝗲𝗺𝗽𝘁𝘀 𝘁𝗼 𝗰𝗲𝗻𝘀𝗼𝗿 𝗱𝗮𝘁𝗮 𝗯𝗿𝗲𝗮𝗰𝗵 𝗰𝗼𝘃𝗲𝗿𝗮𝗴𝗲 The U.S. site emphasizes that it was not named in either ordinance and has no presence or activity in India or Singapore. For this reason, he had already responded to the law firm on June 23, stating that he did not consider himself subject to the jurisdiction of the courts of the two countries and that she did not intend to take any action as a result of the injunctions. https:/...

• Post #4496251

  𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗶𝗻 𝗜𝘁𝗮𝗹𝘆: 𝗥𝗲𝗱𝗔𝗖𝗧 𝗿𝗲𝗽𝗼𝗿𝘁 𝘀𝗵𝗲𝗱𝘀 𝗹𝗶𝗴𝗵𝘁 𝗼𝗻 𝗮𝗻 𝗲𝘃𝗼𝗹𝘃𝗶𝗻𝗴 𝘁𝗵𝗿𝗲𝗮𝘁 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 The report highlights how Italy continues to represent a frequent target for numerous ransomware groups. Organizations affected belong to very different sectors, including manufacturing, services, healthcare, technology, and industrial companies. https://www.suspectfile.com/ransomware-in-italy-redact-report-sheds-light-on-an-evolving-threat-environment/ #Cyber_Threat_Intelligence #Cybercrime #OSINT #ransomNews_on...

• Post #4427861

  𝗢𝗩𝗣 𝗛𝗲𝗮𝗹𝘁𝗵 𝘁𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝗯𝘆 𝗦𝘁𝗼𝗿𝗺: 𝗿𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗴𝗿𝗼𝘂𝗽 𝗰𝗹𝗮𝗶𝗺𝘀 𝘁𝗵𝗲𝗳𝘁 𝗼𝗳 𝟭𝟯𝟬 𝗚𝗕 𝗼𝗳 𝗵𝗲𝗮𝗹𝘁𝗵𝗰𝗮𝗿𝗲 𝗱𝗮𝘁𝗮 One characteristic Storm claims to have adopted concerns the negotiation process. The operators stated that there is no human negotiator involved within the service and that all negotiation stages are automated. Human assistance would reportedly be limited exclusively to technical issues and decryption-related requests. https://www.suspectfile.com/ovp-health-targeted-by-storm-ransomware-group-claims-theft-...

• Post #4174239

  𝗘𝘅𝗰𝗹𝘂𝘀𝗶𝘃𝗲: 𝗕𝗮𝘁𝗵 𝗙𝗶𝘁𝘁𝗲𝗿 𝗖𝗹𝗮𝗶𝗺𝗲𝗱 𝗯𝘆 𝗔𝗻𝘂𝗯𝗶𝘀 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲, 𝗔𝗹𝗹𝗲𝗴𝗲𝗱 𝟲𝟬𝟬 𝗚𝗕 𝗗𝗮𝘁𝗮 𝗧𝗵𝗲𝗳𝘁 𝗙𝗼𝗹𝗹𝗼𝘄𝗲𝗱 𝗯𝘆 𝗮 $𝟮.𝟯𝟱 𝗠𝗶𝗹𝗹𝗶𝗼𝗻 𝗘𝘅𝘁𝗼𝗿𝘁𝗶𝗼𝗻 𝗡𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻 The negotiations, a copy of which was provided by Anubis to SuspectFile, document a familiar pattern increasingly observed in modern double-extortion ransomware operations: technical proof of compromise, demonstrations of data possession, decryptor testing, financial negotiations, and the eventual threat of public disclosure. https://www.suspectfile.com/exclusive-bat...

• Post #3886266

  𝗡𝗮𝘃𝗶𝗴𝗮𝘁𝗲𝟯𝟲𝟬 𝗮𝗻𝗱 𝗣𝟯 𝗚𝗹𝗼𝗯𝗮𝗹 𝗜𝗻𝘁𝗲𝗹: 𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗽𝗿𝗼𝗺𝗶𝘀𝗲 𝗼𝗳 “𝟮𝟬+ 𝘆𝗲𝗮𝗿𝘀 𝗮𝗻𝗱 𝘇𝗲𝗿𝗼 𝘃𝗶𝗼𝗹𝗮𝘁𝗶𝗼𝗻𝘀” 𝘁𝗼 𝘁𝗵𝗿𝗲𝗲 𝗺𝗼𝗻𝘁𝗵𝘀 𝗼𝗳 𝘀𝗶𝗹𝗲𝗻𝗰𝗲 The P3 Global Intel platform was designed to collect reports regarding potentially critical situations within school communities. This means that the information involved could pertain to incidents, behaviors, or circumstances that fall within an extremely private aspect of the lives of students and their families. https://www.suspectfile.com/navigate360-and-p3-global-intel-from-the...

• Post #3836561

  𝗛𝘆𝗳𝗹𝗼𝗰𝗸 𝗮𝗻𝗱 𝗡𝗼𝘃𝗮: 𝗔 𝗣𝗿𝗶𝘃𝗮𝘁𝗲 𝗖𝗼𝗻𝘃𝗲𝗿𝘀𝗮𝘁𝗶𝗼𝗻 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝘀 𝗮 𝗚𝗹𝗶𝗺𝗽𝘀𝗲 𝗶𝗻𝘁𝗼 𝗥𝗮𝗻𝘀𝗼𝗺𝘄𝗮𝗿𝗲 𝗚𝗿𝗼𝘂𝗽 𝗗𝘆𝗻𝗮𝗺𝗶𝗰𝘀 The chat, which took place between July 1 and July 6, 2026, concerns a request to join Nova’s affiliate program and contains a series of statements regarding the Hyflock group, the interlocutor’s role, and his alleged technical expertise. https://www.suspectfile.com/hyflock-and-nova-a-private-conversation-provides-a-glimpse-into-ransomware-group-dynamics/ #Hyflock #LockBit #Nova #Qilin #RaaS #Ransomware

• Post #3770691

  𝗡𝗼𝗿𝘁𝗵𝗲𝗮𝘀𝘁 𝗣𝗲𝗱𝗶𝗮𝘁𝗿𝗶𝗰𝘀 𝗲𝗻𝘁𝗲𝗿𝘀 𝗻𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻𝘀 𝘄𝗶𝘁𝗵 𝗔𝗻𝘂𝗯𝗶𝘀, 𝘁𝗵𝗲𝗻 𝘀𝗶𝗹𝗲𝗻𝗰𝗲. 𝗦𝘂𝘀𝗽𝗲𝗰𝘁𝗙𝗶𝗹𝗲 𝗿𝗲𝗰𝗼𝗻𝘀𝘁𝗿𝘂𝗰𝘁𝘀 𝘁𝗵𝗲 𝗻𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻 𝘁𝗵𝗮𝘁 𝗽𝗿𝗲𝗰𝗲𝗱𝗲𝗱 𝘁𝗵𝗲 𝗱𝗮𝘁𝗮 𝗽𝘂𝗯𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 For ethical and privacy reasons, SuspectFile has chosen not to analyze or describe documentation relating to minor patients, as Northeast Pediatrics is a healthcare facility specialized in pediatric care. https://www.suspectfile.com/northeast-pediatrics-enters-negotiations-with-anubis-then-silence-suspectfile-reconstructs-the-negotiation-that-preceded-...