Akira and SafePay ransomware groups claim dozens of victims.

Summary

By the CyberWire staff

At a glance.

Akira and SafePay ransomware groups claim dozens of victims.
ClickFix attacks trick users into running malicious PowerShell commands.
US Justice Department charges alleged Phobos ransomware administrator.

Akira and SafePay ransomware groups claim dozens of victims.

The Akira ransomware group posted 32 victims to its leak site in a single day last week, according to researchers at Cyberint. The ransomware-as-a-service operation claims to have compromised more than 350 organizations since its emergence in March 2023. Most of its recent victims are located in the United States.

Separately, researchers at Huntress warn that the relatively new ransomware gang "SafePay" has claimed 22 victims as of November 14th. The group's ransomware appears to be built using the leaked LockBit source code. Huntress analyzed two of the group's attacks, noting, "In both incidents, the threat actor’s activity was found to originate from a VPN gateway or portal, as all observed IP addresses assigned to threat actor workstations were within the internal range. The threat actor was able to use valid credentials to access customer endpoints, and was not observed enabling RDP, nor creating new user accounts, nor creating any other persistence."

How CISOs are tackling the realities of AI adoption

How are security leaders navigating AI adoption? Hear from leading CISOs in the latest Tines report, CISO Perspectives: Separating the Reality of AI from the Hype.

What to expect:

Top challenges CISOs are facing in AI adoption
Key opportunities AI presents for security teams
Strategies for handling the added pressure AI brings

Get the report to learn why 74% of CISOs believe AI will introduce more benefits than risks to the SOC.

ClickFix attacks trick users into running malicious PowerShell commands.

Proofpoint describes a social engineering technique dubbed "ClickFix," which attempts to trick users into copying and pasting PowerShell commands to install malware. Proofpoint explains, "The ClickFix technique is used by multiple different threat actors and can originate via compromised websites, documents, HTML attachments, malicious URLs, etc. In most cases, when directed to the malicious URL or file, users are shown a dialog box that suggests an error occurred when trying to open a document or webpage. This dialog box includes instructions that appear to describe how to 'fix' the problem, but will either: automatically copy and paste a malicious script into the PowerShell terminal, or the Windows Run dialog box, to eventually run a malicious script via PowerShell; or provide a user with instructions on how to manually open PowerShell and copy and paste the provided command."

The technique has been used to install a range of malware strains, including AsyncRAT, Danabot, DarkGate, Lumma Stealer, and NetSupport.

Survey Your Security Perimeter with a Free Security Assessment

By getting started with a free identity security assessment, Cisco can help you find and secure the gaps in your identity infrastructure and provide insights for improving your identity posture. Outcomes of the assessment include:

A complete view of your identity security posture
A detailed view of all identities and devices logging into your network
An analysis of your multi-factor authentication usage and adoption
A snapshot of your total number of inactive accounts

Request Your Free Identity Security Assessment Today

US Justice Department charges alleged Phobos ransomware administrator.

The US Justice Department has charged a 42-year-old Russian national named Evgenii Ptitsyn as an alleged administrator of the Phobos ransomware-as-a-service operation. The defendant was extradited from South Korea and appeared before the US District Court for the District of Maryland earlier this month. The Justice Department says Phobos affiliates have "victimized more than 1,000 public and private entities in the United States and around the world, and extorted ransom payments worth more than $16 million dollars."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting the Republic of Korea, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

November 18 Advisory: Windows KDC Proxy Remote Code Execution Vulnerability [CVE-2024-43639] (Censys) CVE-2024-43639 is a critical vulnerability in the Windows Kerberos authentication protocol that allows unauthenticated attackers to execute remote code on affected systems.

CISA Adds Three Known Exploited Vulnerabilities to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape | Proofpoint US (Proofpoint) What happened Proofpoint researchers have identified an increase in a unique social engineering technique called ClickFix. And the lures are getting even more clever.

Dropbox Phishing Attack Capitalizing on Open Enrollment (Abnormal) Discover how Dropbox was exploited in a sophisticated phishing attack that leveraged AiTM tactics to steal credentials during the open enrollment period.

Inside Bitdefender Labs’ Investigation of a Malicious Facebook Ad Campaign Targeting Bitwarden Users (Bitdefender Labs) Throughout 2024, Bitdefender Labs has been closely monitoring a series of malvertising campaigns that exploit popular platforms to spread malware.

Products, Services, and Solutions

DTEX Brings Insider Risk Management to Windows on Snapdragon X Series (GlobeNewswire News Room) New support enhances security for AI-powered devices and helps govern GenAI use...

Technologies, Techniques, and Standards

Protecting Signal Keys on Desktop (The Cryptography Caffè) This blogpost describes our investigation and proof of concept to enhance the security of Signal Messenger key management on desktop.

Legislation, Policy, and Regulation

More Spyware, Fewer Rules: What Trump’s Return Means for US Cybersecurity (WIRED) Experts expect Donald Trump’s next administration to relax cybersecurity rules on businesses, abandon concerns around human rights, and take an aggressive stance against the cyber armies of US adversaries.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

ISC2 SECURE Washington, DC (Virtual, Dec 4 - 5, 2024) You’re invited to participate in powerful collaboration and discover the latest topics impacting the cybersecurity profession. Join us for ISC2 SECURE Washington, DC, Live online on December 4-5, 2024! Over two days of interactive sessions, cybersecurity experts will address common challenges shared by government entities and the private sector/industry - not just in DC but around the globe. After a number of major national and global cybersecurity incidents in 2024, its clear we're all part of one ecosystem that must remain a united front to ensure resilience in the face of threats. Make an impact on the security of your organization’s assets and data with actionable ideas and strategies from this important event.  Members earn up to 7.5 CPE credits.

ISC2 Security Congress 2025 (Nashville + Virtual, Tennessee, USA, Oct 29 - 31, 2025) Join thousands of cybersecurity experts at ISC2 Security Congress 2025 and help lead the future of our connected world. Gain the insights you need to stay ahead of the evolving digital landscape. From innovative software to new security strategies, ISC2 Security Congress 2025 is designed to ensure you can navigate tomorrow’s threats.

Events

SANS Holiday Hack Cybersecurity Challenge 2024: Snow-maggedon (Vienna, Nov 7 - Dec 2, 2024) Whether you're a first-time player or a seasoned participant, this year’s Holiday Hack brings exciting new features you won’t want to miss! We’ve introduced a new dynamic for this year: challenges will be gradually released in sync with the story, keeping the experience fresh and immersive. See challenges release dates and new features included.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat Summit has been at the forefront of the satellite industry’s burgeoning cybersecurity landscape since the event’s launch in 2017. Initially run as a single annual event, it morphed into two separate events in recent years – CyberLEO and CyberSatGov. This was done in response to changing market conditions, most notably the huge growth of LEO satellites and the corresponding rise of commercial interest in space. While CyberSatGov and CyberLEO were successful independently, the continued demand for LEO architectures and the ever-increasing collaboration between government and industry meant that these conversations needed to happen under one roof. As a result, 2024 will feature a single CyberSat event in November, where for the first time in its 7-year history, we will nearly double the event’s content offerings to include two concurrent tracks – one track titled “Space Infrastructure” and the second track titled “Space Data & Technology.” The “Space Infrastructure” track will continue CyberSat’s legacy focus on the overall satellite cybersecurity ecosystem and the protection of tangible assets like ground systems and satellite components, while the new “Space Data & Technology” track will focus on emerging technologies and the protection of space’s intangible assets like data. Keynotes, and a handful of general sessions, will contain talks that apply to all attendees.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat is the only space security event that successfully unites satellite, space, cyber, and government to educate on threat vectors and to thwart next-generation attacks.

CYBERWARCON (Arlington + Virtual, Virginia, USA, Nov 22, 2024) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds including the military and government, academia, the media, and the private sector.

AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.19.24

At a glance.

Akira and SafePay ransomware groups claim dozens of victims.

ClickFix attacks trick users into running malicious PowerShell commands.

US Justice Department charges alleged Phobos ransomware administrator.

Notes.

Attacks, Threats, and Vulnerabilities

Products, Services, and Solutions

Technologies, Techniques, and Standards

Legislation, Policy, and Regulation

Newly Noted Events

Events