11 ruinöse Ransomware-Bedrohungen | CSO Online

Cybersecurity Threats: Qilin and RansomHub

Qilin Ransomware

Modus Operandi:
Qilin targets primarily Windows and Linux systems, primarily through:
• Legitimate (stolen or purchased) access credentials
• Social Engineering attacks

Targets:
Qilin primarily attacks companies in the USA and Europe, excluding the GUS states, with a focus on industrial and service companies.

Attribution:
The Qilin group members are still unknown, but security experts believe that at least some connections exist with Russia, based on relevant forum entries.

RansomHub

Background:
RansomHub was first observed in February 2024 and has since developed into one of the largest new ransomware threats. This could be due to the group’s alleged ability to recruit members from other cybercrime organizations, including LockBit and BlackCat.

Modus Operandi:
Initial access to systems is typically gained through:
• Spear Phishing
• Known vulnerabilities
• Password Spraying

Targets:
RansomHub has been linked to more than 200 attacks on various companies and organizations across different sectors, including government agencies and KRITIS providers in the USA and Europe.

Attribution:
Indicators point to an organized, Russian-speaking cybercrime operation with connections to other established ransomware actors.

Conclusion:

In conclusion, Qilin and RansomHub are two significant cybersecurity threats that organizations should be aware of. Understanding their modus operandi, targets, and attribution can help in the development of effective countermeasures.

FAQs

Q: What is Qilin Ransomware?
A: Qilin is a type of ransomware that targets Windows and Linux systems, primarily through legitimate access credentials and social engineering attacks.

Q: What is RansomHub?
A: RansomHub is a large and growing ransomware threat that has been linked to over 200 attacks on various companies and organizations.

Q: What are the primary targets of Qilin and RansomHub?
A: Qilin primarily targets companies in the USA and Europe, excluding GUS states, while RansomHub targets a wide range of industries and sectors.

Q: What is the attribution of Qilin and RansomHub?
A: Qilin’s members are unknown, but security experts believe that Qilin has connections with Russia. RansomHub is attributed to an organized, Russian-speaking cybercrime operation with connections to other established ransomware actors.