Threat Source newsletter (Nov. 4, 2021)
Summary: Cisco Talos discovered a Babuk ransomware campaign, attributed to an actor called Tortilla operating since July 2021, predominantly affecting users in the U.S. with smaller numbers of infections in the U.K., Germany, Ukraine, Finland, Brazil, Honduras and Thailand. Talos assesses with moderate confidence that initial infection came through exploitation of ProxyShell vulnerabilities in Microsoft Exchange Server via a China Chopper web shell.
What you should know: The Exchange flaws that made headlines earlier this year are still being used to deploy ransomware, and Talos rates its own confidence in the infection path only moderate - meaning the entry point into your environment may not be the one you patched for.
Read the original at Cisco Talos ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026