The Finish National Cybersecurity Center is informing of increased Akira ransomware activity in December, targeting companies in the country and wiping backups.
The agency says that the threat actor's attacks accounted for six out of the seven cases of ransomware incidents reported last month.
Wiping the backups amplifies the damage of the attack and allows the threat actor to put more pressure on the victim as they eliminate the option of restoring the data without paying a ransom.
Smaller organizations often use network-attached storage devices for this purpose, but the Finnish agency highlights that these systems were not spared in Akira ransomware attacks.
The attackers also targeted tape backup devices, which are typically used as a secondary system for storing digital copies of the data.
The NCSC-FI suggests that organizations switch to using offline backups instead, spreading the copies across various locations to protect them from unauthorized physical access.
The vulnerability allows unauthorized attackers to carry out brute force attacks and find the credentials of existing users, where there is no login protection such as multi-factor authentication.
CVE-2023-20269 was acknowledged by Cisco as a zero-day in September 2023 and fixes were released the following month.
Security researchers reported since early August 2023 that Akira ransomware had been leveraging it for access.
The observed post-compromise activity includes mapping the network, targeting backups and critical servers, stealing usernames and passwords from Windows servers, encrypting important files, and encrypting disks of virtual machines on virtualization servers, particularly those using VMware products.
To avoid attacks that exploit this vulnerability, organizations are strongly recommended to upgrade to Cisco ASA 9.16.2.11 or later and Cisco FTD 6.6.7 or later.
Nissan Australia cyberattack claimed by Akira ransomware gang.
Cisco says critical Unity Connection bug lets attackers get root.
Fidelity National Financial: Hackers stole data of 1.3 million people.
Ransomware victims targeted by fake hack-back offers.
Hackers target Microsoft SQL servers in Mimic ransomware attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 11 Jan 2024 15:05:28 +0000