Cybersecurity Policy Report, Agencies Warn of Ransomware Exploiting Unpatched Systems, (Feb 20, 2025)
A China-based ransomware group is attacking critical infrastructure by exploiting systems that should have been patched, according to an advisory published yesterday by the Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, and Multi-State Information Sharing and Analysis Center.
Known as “Ghost,” the ransomware group has attacked organizations running outdated versions of software and firmware for Internet-facing services since 2021, the advisory noted.
“This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China,” it said.
“Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses,” it said.
The advisory provides tactics, techniques, and procedures (TTPs) used by the group and indicators of compromise (IOCs) and recommends that organizations patch outdated software, maintain data backups, and adopt “phishing-resistant” multifactor authentication.
News: FederalLegislation DataSecurity