Risky Business #694 -- Cleansing fire claims ESXi, GoAnywhere servers

PLUS: ION Group coughs up Lockbit ransom…
08 Feb 2023 » Risky Business

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Unpatched ESXi boxes are getting rinsed
  • GoAnywhere MFT file transfer boxes are too
  • Royal Mail data being ransomed by Lockbit
  • Advanced materials manufacturer and finance company among latest rware victims
  • Guilty plea in Ubiquiti case
  • Much, much more

This week’s show is brought to you by Red Canary. Red Canary’s Adam Mashinchi is this week’s sponsor guest. He joins us to talk about the impact layoffs are having on infosec teams.

Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that’s your thing.

Show notes

Risky Biz News: Ransomware wave hits thousands of VMWare ESXi servers
Risky Biz News: Zero-day alert for GoAnywhere file transfer servers
Royal Mail faces threat from ransomware group LockBit | Reuters
ION brings clients back online after ransomware attack: Source | Business Insurance
Hackers who breached ION say ransom paid; company declines comment | Reuters
Blow to Morgan Advanced Materials as cyber-attack to cost millions to deal with | Evening Standard
K-12 schools in Tucson, Nantucket respond to cyberattacks - The Record from Recorded Future News
Ransomware gang attempts to extort UK school by posting files about at-risk children - The Record from Recorded Future News
British steel industry supplier Vesuvius ‘currently managing cyber incident’ - The Record from Recorded Future News
Tallahassee hospital diverting patients, canceling non-emergency surgeries after cyberattack - The Record from Recorded Future News
All classes canceled at Irish university as it announces ‘significant IT breach’ - The Record from Recorded Future News
Switzerland’s largest university confirms ‘serious cyberattack’ - The Record from Recorded Future News
Dutch Police Read Messages of Encrypted Messenger 'Exclu'
Julius 'zeekill' Kivimäki, former Lizard Squad hacker, arrested in France - The Record from Recorded Future News
New York attorney general fines developer of stalking apps - The Record from Recorded Future News
Microsoft alleges attacks on French magazine came from Iranian-backed group | Ars Technica
Hackers linked to North Korea targeted Indian medical org, energy sector - The Record from Recorded Future News
Google Cuts Company Protecting People From Surveillance To A ‘Skeleton Crew,’ Say Laid Off Workers
Feds get guilty plea in Ubiquiti data extortion case - The Record from Recorded Future News
For Hire: Ex-Ubiquiti Developer Charged With Extortion
Microsoft notifies UK customers affected by hackers abusing ‘verified publisher’ tag - The Record from Recorded Future News
Darknet drug market BlackSprut openly advertises on billboards in Moscow - The Record from Recorded Future News
Toyota sealed up a backdoor to its global supplier management network | The Daily Swig