securityaffairs.com Open in urlscan Pro
2606:4700:3031::6815:90b  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MUST READ

Headlines
 * The latest variant of the RapperBot botnet adds cryptojacking capabilities
 * Capita warns customers to assume that their data was stolen
 * Security Affairs newsletter Round 419 by Pierluigi Paganini – International
   edition
 * Personal info of 90k hikers leaked by French tourism company La Malle Postale
 * Data of more than 2M Toyota customers exposed in ten years-long data breach
 * Discord suffered a data after third-party support agent was hacked



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


BL00DY RANSOMWARE GANG ACTIVELY TARGETS THE EDUCATION SECTOR EXPLOITING PAPERCUT
RCE

May 12, 2023  By Pierluigi Paganini




U.S. CISA AND FBI WARNED OF ATTACKS CONDUCTED BY THE BL00DY RANSOMWARE GANG
AGAINST THE EDUCATION SECTOR IN THE COUNTRY.

The FBI and CISA issued a joint advisory warning that the Bl00dy Ransomware
group is actively targeting the education sector by exploiting the PaperCut
remote-code execution vulnerability CVE-2023-27350.

The Bl00dy ransomware has been active since May 2022, it has been the first
group that started using the leaked LockBit ransomware builder in attacks in the
wild.

According to the FBI, threat actors started exploiting the CVE-2023-27350 flaw
in mid-April 2023 and the attacks are still ongoing. The attacks against the
Education Facilities Subsector started in early May.

The report states that the gang is targeting the Education Facilities Subsector
entities because they maintained approximately 68% of exposed, but not
necessarily vulnerable, U.S.-based PaperCut servers.

As a result of some of these attacks, threat actors exfiltrated data of the
victim systems and demanded the payment of a ransom for the decryption of
encrypted files.



“According to FBI information, legitimate remote management and maintenance
(RMM) software was downloaded and executed on victim systems via commands issued
through PaperCut’s print scripting interface. External network communications
through Tor and/or other proxies from inside victim networks helped Bl00dy Gang
ransomware actors mask their malicious network traffic.” reads the joint alert.
“The FBI also identified information relating to the download and execution of
command and control (C2) malware such as DiceLoader, TrueBot, and Cobalt Strike
Beacons, although it is unclear at which stage in the attack these tools were
executed.”

The US agencies recommend network defenders focus detection efforts on network
traffic signatures, system monitoring, and server settings and log files.



The report also provided Indicators of Compromise (IoCs) for this threat.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best
European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name
Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

> > Nominate Pierluigi Paganini and Security Affairs here
> > here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


Bl00Dy RansomwareCybercrimeeducation sectorHackinghacking newsinformation
security newsIT Information SecuritymalwarePierluigi PaganiniSecurity
AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Leaked source code of Babuk ransomware used by 10 different ransomware families
targeting VMware ESXi

NEXT ARTICLE

Russia-affiliated CheckMate ransomware quietly targets popular file-sharing
protocol

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


THE LATEST VARIANT OF THE RAPPERBOT BOTNET ADDS CRYPTOJACKING CAPABILITIES

May 14, 2023  By Pierluigi Paganini

CAPITA WARNS CUSTOMERS TO ASSUME THAT THEIR DATA WAS STOLEN

May 14, 2023  By Pierluigi Paganini






 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER
   
   


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

LEAKED SOURCE CODE OF BABUK RANSOMWARE USED BY 10 DIFFERENT RANSOMWARE FAMILIES
TARGETING VMWARE ESXI

The leak of the source code of the Babuk ransomware allowed 9 ransomware gangs
to create their own ransomware targeting...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version