Unmasking EncryptHub Ransomware Using ChatGPT and OPSEC Flaws

A critical ransomware has been created by a Ukrainian hacker known as EncryptHub.

Pulse ID: 67f16f89202ad18608e614e7
Pulse Link: https://otx.alienvault.com/pulse/67f16f89202ad18608e614e7
Pulse Author: cryptocti
Created: 2025-04-05 17:59:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Port of #Seattle says #ransomware breach impacts 90,000 people

https://www.bleepingcomputer.com/news/security/port-of-seattle-says-ransomware-breach-impacts-90-000-people/

New post from #Space Bears : L&S Mechanical (Reuploaded)
More at : https://www.ransomlook.io/group/Space%20Bears #Ransomware

New post from #Space Bears : Industrial Corona De México
More at : https://www.ransomlook.io/group/Space%20Bears #Ransomware

#NSA warns “fast flux” threatens national #security. What is fast flux anyway?

A technique that hostile nation-states & financially motivated #ransomware groups are using to hide their operations poses a threat to critical #infrastructure & national security, the NSA has warned.

The technique is known as #FastFlux. It allows decentralized networks operated by threat actors to hide their infrastructure and survive takedown attempts that would otherwise succeed
#privacy

https://arstechnica.com/security/2025/04/nsa-warns-that-overlooked-botnet-technique-threatens-national-security/

DATE: April 04, 2025 at 06:28PM
SOURCE: HEALTHCARE INFO SECURITY

Direct article link at end of text block below.

Are #Hospitals Ready for the Next Major Disaster? https://t.co/3whdfSY3de #ransomware #hurricane #disasterrecovery

Here are any URLs found in the article text:

https://t.co/3whdfSY3de

Articles can be found by scrolling down the page at https://www.healthcareinfosecurity.com/ under the title "Latest"

-------------------------------------------------

Private, vetted email list for mental health professionals: https://www.clinicians-exchange.org

Healthcare security & privacy posts not related to IT or infosec are at @HIPAABot . Even so, they mix in some infosec with the legal & regulatory information.

-------------------------------------------------

#security #healthcare #doctors #itsecurity #hacking #doxxing #psychotherapy #securitynews #psychotherapist #mentalhealth #psychiatry #hospital #socialwork #datasecurity #webbeacons #cookies #HIPAA #privacy #datanalytics #healthcaresecurity #healthitsecurity #patientrecords @infosec #telehealth #netneutrality #socialengineering

#HuntersInternational shifts from #ransomware to pure data extortion

https://www.bleepingcomputer.com/news/security/hunters-international-rebrands-as-world-leaks-in-shift-to-data-extortion/

#Ransomware

rheinmetall[.]com (#Rheinmetall #Defence)

Group Name: #babuk2
https://m.ransomware.live/id/cmhlaW5tZXRhbGwuY29tIChSaGVpbm1ldGFsbCBEZWZlbmNlKUBiYWJ1azI=

#Texas #StateBar warns of data breach after #INC #ransomware claims attack

https://www.bleepingcomputer.com/news/security/texas-state-bar-warns-of-data-breach-after-inc-ransomware-claims-attack/

Die Babuk Ransomware Gruppe (babuk-bjorka) hat heute auf ihrer Website im Darknet bekanntgegeben, dass sie Rheinmetall Defence (rheinmetall.com) gehackt hat.

16 months after they experienced a ransomware attack, Dameron Hospital notifies those affected:

https://databreaches.net/2025/04/04/16-months-after-they-experienced-a-ransomware-attack-dameron-hospital-notifies-those-affected/

HellCat ransomware: what you need to know - HellCat - the ransomware gang that has been known to demand payment... in baguettes!

A... https://www.tripwire.com/state-of-security/hellcat-ransomware-what-you-need-know #ransomware #guestblog #malware

HellCat - the ransomware gang that has been known to demand payment... in baguettes!

Are they rolling in the dough? Bread all about it in my article on the Tripwire blog: https://www.tripwire.com/state-of-security/hellcat-ransomware-what-you-need-know

Ransomware-Angriff: Regionale Verkehrsbetriebe Baden-Wettingen (RVBW) #Ransomware #Einbruch #Datendiebstahl #TeamInfoSec #cyberangriff https://www.security-incidents.de/sicherheitsvorfaelle/ransomware_angriff_regionale-verkehrsbetriebe-8982.php

Here's some really interesting analysis of the new Babuk2 not-quite-ransomware operation.

We've not been reporting on this one much because something seemed off about the way these guys operated, and it turns out my gut was kinda correct - just not in the way I thought it was.

#cybersecurity #ransomware

https://www.cyberdaily.au/security/11934-babuk2-and-the-dark-art-of-ransomware-data-commoditisation

Killsec strikes again, this time claiming the scalp of a Victorian video marketing agency with a rather lengthy - and impressive - list of clients.

Many of whom appear to be impacted in some form by this apparent breach.

#cybersecurity #ransomware

https://www.cyberdaily.au/security/11932-exclusive-aussie-creative-agency-fancy-films-hit-by-alleged-killsec-hack

Daixin published some leak files titled "A little gift of exclusive data for everyone." They claim 17k PII PHI records. It looks like 17 sections of a database download. The attribute names look like it might be a pediatric hospital or something since most of them revolve around birth, peds, parents, etc. Also, at least the first several records appear to be UK based. If that sounds like it might be in your AO, you might want to look into it since the post wasn't titled anything obvious.

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen er­be­ten

als PDF:

https://cryptpad.digitalcourage.de/file/#/2/file/NdmBgSYkRCto8B+JmJkE9mQ4/

 #DSGVO #TDDDG ( #unplugtrump )
#Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #SoloKey #NitroKey #Email #Cybersecurity #Pixelfed #Massenűberwachung
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Apple #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone  #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification
#Bloatware #TPM #Murena  #LiberaPay #GnuTaler #Taler #PreppingforFuture
#FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

DragonForce Claims to Be Taking Over RansomHub Ransomware Infrastructure https://thecyberexpress.com/dragonforce-claims-to-be-taking-over-ransomhub/ #DragonForceransomware #TheCyberExpressNews #TheCyberExpress #FirewallDaily #Ransomware #CyberNews #RansomHub

DragonForce appears to be taking over the infrastructure of RansomHub, the largest ransomware group. A huge scoop courtesy of the Cyble threat intelligence research team. #Ransomware #Cybersecurity #ThreatIntelligence

https://thecyberexpress.com/dragonforce-claims-to-be-taking-over-ransomhub/