Forest Global Training Partners

Cyber Risks · Cisco Talos

Cyber Security Week in Review (March 28)

Summary: Ransomware incidents in Japan rose 4.7% year over year, with The Gentlemen the most active group as its leak-site listings more than doubled from January to July and Qilin ranked second and appeared to use AI. Small and medium-sized enterprises with capital under JPY 1 billion made up 80% of victims, and the Chaos group used new malware called "msaRAT" that hijacks browsers, connecting through the browser rather than directly to command-and-control to hide the attacker's IP via WebRTC over TURN.

What's compelling: Four in five victims were SMEs with capital under JPY 1 billion, and msaRAT's browser-routed traffic means the attacker's IP never appears in your logs - the infrastructure you would normally pivot on to trace an intrusion is not there.

Read the original at Cisco Talos ↗

Topics
Malware
Related