Breach Disclosure: UC Berkeley

On Monday, March 29, 2021, multiple employees at UC Berkeley received emails from a threat actor claiming that their data was stolen and was going to be released. According to Portswigger, the emails contained a link to a sample of the stolen data. On March 31, 2021, The University of California Office of the President confirmed the breach, and that attackers gained access to UC Berekeley through their Accellion instance. The breach contained approximately 547,000 unique email addresses, social security numbers and other personal data.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The Accellion breach by the Cl0p ransomware group has affected a number of higher education institutions. A user on reddit posted a screenshot of the disclosure email from UC Berkeley.

Although there has been no definitive link between the Cl0p ransomware group and the UC Berkeley breach, such as a shame site posting for UC Berkeley, it is likely actors used the widely reported Accellion vulnerabilities to break into UC Berkeley. A number of ransomware groups use the scare tactics listed in the above email in order to bring a sense of panic to the affected organization. Brian Krebs wrote an article in April 2021 that details an email sent from Cl0p to customers of RaceTrac Petroleum, who was ransomwared by Cl0p earlier this year.

The 4 Accellion FTA 0-days used by Cl0p, as documented by Threatpost are listed in the ZeroFOX Vulnerability Intelligence Product under the following links:

• CVE-2021-27101 – SQL injection via a crafted Host header
• CVE-2021-27102 – OS command execution via a local web service call
• CVE-2021-27103 – SSRF via a crafted POST request
• CVE-2021-27104 – OS command execution via a crafted POST request

Breaking News: 2021-06-18 - 2021-06-24

Egg free Cake Box suffer data breach exposing credit card numbers - BleepingComputer

Eggfree Cake Box has disclosed a data breach after threat actors hacked their website to stole credit card numbers. Cake Box is a UK chain of stores selling fresh cake, with currently 64 Cake Box stores located throughout the United Kingdom. Cake Box learned of the breach on April 27th, 2020, where their website was hacked to include malicious scripts that stole customer information, including credit cards, submitted to the site. The company has sent an official mail to notify all the affected customers.

See the full report here: https://www.bleepingcomputer.com/news/security/egg-free-cake-box-suffer-data-breach-exposing-credit-card-numbers/

Carnival Cruise hit by data breach, warns of data misuse risk - BleepingComputer

Carnival Corporation, the world's largest cruise ship operator, has disclosed a data breach after attackers gained access to some of its IT systems and the personal, financial, and health information belonging to customers, employees, and crew. Unauthorized third-party access to a limited number of email accounts was detected on March 19, 2021. The accessed information included names, addresses, phone numbers, passport numbers, dates of birth, health information, and, in some limited instances, additional personal information like Social Security or national identification numbers. The company has notified all the affected employees and customers.

See the full report here: https://www.bleepingcomputer.com/news/security/carnival-cruise-hit-by-data-breach-warns-of-data-misuse-risk/

Cisco Smart Switches Riddled with Severe Security Holes

Cisco has flagged and patched several high-severity security vulnerabilities in its Cisco Small Business 220 Series Smart Switches that could allow session hijacking, arbitrary code execution, cross-site scripting and HTML injection. It also issued fixes for high-severity problems in the AnyConnect secure mobility client, the Cisco DNA Center, and the Cisco Email Security Appliance, along with a slew of patches for medium-severity vulnerabilities in AnyConnect, Jabber, Meeting Server, Unified Intelligence Center and Webex. Users are advised to update to the latest fixed versions to remediate the vulnerabilities.

See the full report here: https://threatpost.com/cisco-smart-switches-security-holes/167031/

Threat Actors Use Google Docs to Host Phishing Attacks

Threat actors are exploiting Google Docs by hosting their attacks within the web-based document service in a new phishing campaign that delivers malicious links aimed at stealing victims’ credentials. By hosting attacks in this way, attackers can bypass link scanners and evade detection from common security protections that aim to verify that links sent via email are legitimate. The exploit is widely being used to exploit document services to deliver malicious links in order to steal victims' credentials.

See the full report here: https://threatpost.com/google-docs-host-attack/166998/

Three UK telco bug has customers receiving and making random calls - BleepingComputer

Customers of the Three UK telco company are panicking as they receive a series of random phone calls due to an ongoing issue. Three is the fourth-largest British telecom giant and Internet Service Provider (ISP) with 13.3 million subscribers as of 2020. The company has acknowledged the technical issue and is working towards remediation.

See the full report here: https://www.bleepingcomputer.com/news/technology/three-uk-telco-bug-has-customers-receiving-and-making-random-calls/

US supermarket chain Wegmans notifies customers of data breach - BleepingComputer

Wegmans Food Markets notified customers that some of their information was exposed after the company became aware that two of its databases were publicly accessible on the Internet because of a configuration issue. Due to a previously undiscovered configuration issue, two of the cloud databases, which are used for business purposes and are meant to be kept internal to Wegmans, were inadvertently left open to potential outside access. Customer information exposed in the data breach included names, addresses, phone numbers, birth dates, Shoppers Club numbers, and Wegmans.com account e-mail addresses and passwords.

See the full report here: https://www.bleepingcomputer.com/news/security/us-supermarket-chain-wegmans-notifies-customers-of-data-breach/

HBO Max emailed a mysterious "Integration Test" to all subscribers - BleepingComputer

​Social media was abuzz yesterday night after thousands of HBO Max subscribers received strange emails titled "Integration Test Email 1". The email was likely a mistake by an HBO Max developer or marketing person performing some tests on their platform and mistakenly sent out an email to all of the streaming network's subscribers. The email seems to be harmless as it contained a message stating, "This template is used by integration tests only".

See the full report here: https://www.bleepingcomputer.com/news/technology/hbo-max-blames-mistaken-integration-test-email-on-an-intern/

South Korea's Nuclear Research agency hacked using VPN flaw

The Korea Atomic Energy Research Institute, or KAERI, states that a cyber-attack took place on June 14th, 2021, after North Korean threat actors breached their internal network using a VPN vulnerability. The evidence linking the threat actor to the infamous threat group 'Kimsuky' but the investigation is ongoing and they are yet to confirm what information has been accessed.

See the full report here: https://www.bleepingcomputer.com/news/security/south-koreas-nuclear-research-agency-hacked-using-vpn-flaw/

iPhone bug breaks WiFi when you join hotspot with unusual name

​A new iPhone bug can break the iPhone's wireless functionality by merely connecting to a specific WiFi hotspot. This bug is not permanent and could be fixed by implementing some resetting steps under the Settings feature in the device. A bug like this could be exploited by malicious actors planting rogue WiFi hotspots in popular areas to damage iPhone devices connecting to them.

See the full report here: https://www.bleepingcomputer.com/news/security/iphone-bug-breaks-wifi-when-you-join-hotspot-with-unusual-name/

Toronto’s Humber River Hospital under code grey after ransomware attack - Global News

One of the facilities of Humber River Hospital in Toronto’s north end was hit by so-called zero-day ransomware of a new malware variant which forced staff to declare a code grey (a loss of essential services). While the emergency department is still operational but some clinics were canceled and ambulances were redirected. Officials are trying to restore their computer systems and making changes to prevent the situation from happening again.

See the full report here: https://globalnews.ca/news/7963652/humber-river-hospital-ransomware-attack-toronto/

UNC2465 cybercrime group launched a supply chain attack on CCTV vendor

Mandiant researchers discovered a campaign, tracked as UNC2465, considered to be an affiliate of the Darkside ransomware gang. The operators conducted a supply chain attack against a CCTV vendor. The attackers compromised the website of the vendor and implanted malicious code in a Windows application, a custom version of the Dahua SmartPSS Windows app, that the company provides to its customers to control their security feeds. Experts recommend scanning internal networks for the SmartPSS app and search for Indicators of Compromise associated with the SMOKEDHAM backdoor.

See the full report here: https://securityaffairs.co/wordpress/119051/cyber-crime/unc2465-supply-chain-attack.html?utm_source=rss&utm_medium=rss&utm_campaign=unc2465-supply-chain-attack

Russia bans Opera VPN and VyprVPN, classifies them as threats - BleepingComputer

Roskomnadzor, Russia's telecommunications watchdog, has banned the use of Opera VPN and VyprVPN after classifying them as threats according to current Russian law. Following the regulation on responding to threats to circumvent restrictions on access to child pornography, suicidal, pro-narcotic, and other prohibited content, restrictions on the use of VPN services VyprVPN and Opera VPN will be introduced from June 17, 2021, the Roskomnadzor said.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-bans-opera-vpn-and-vyprvpn-classifies-them-as-threats/

Headaches continue for patients and staff three weeks into hospital ransomware attack - Villages-News

Nearly three weeks after a ransomware attack was launched against computers at UF Health-The Villages Hospital and Leesburg Regional Medical Center, there seems to be no end in sight for suffering patients and staff. The hospital has been tight-lipped about the cyberattack, initially dismissing it as a computer glitch.

See the full report here: https://www.villages-news.com/2021/06/19/headaches-continue-for-patients-and-staff-three-weeks-into-hospital-ransomware-attack/

Vigilante malware blocks people from downloading pirated content - grmdaily.com

An online vigilante has created a new piece of malware that prevents those who unwillingly download it from visiting illegal pirate websites. Using popular crack sites and pirating libraries, the vigilantes distribute the virus which makes it impossible for users to access content such as games, movies, and music.

See the full report here: https://grmdaily.com/vigilante-malware-blocks-pirate-websites/

Tinder spam campaign hides "handwritten" links in profile images - BleepingComputer

A new trend has emerged on dating apps like Tinder, with spammers sneaking in links within profile images. However, unlike with other dating apps, where spammers send unsolicited links to users via direct text messages, this slightly more clever technique abuses profile pictures to sneak in images of handwritten domains within them.

See the full report here: https://www.bleepingcomputer.com/news/technology/tinder-spam-campaign-hides-handwritten-links-in-profile-images/

Have you heard of #smishing? SMS-based #phishing attacks are nothing new BUT they're rising AND rapidly. Learn about recent smishing attacks and their means of delivery in our report:

Cyberint, a cybersecurity firm, has seen an increase in SMS phishing attacks targeting the customers of retail companies. Recent campaigns showed that attackers are taking advantage of the massive increase in online shopping by impersonating retailers and shipping companies to extract credentials and other victim details. This type of scam is global and is conducted in numerous countries and languages including Russian, Spanish, Japanese, and Arabic.

See the full report here: https://blog.cyberint.com/new-sms-phishing-campaigns-target-retail-customers

Google warns over 2bn Chrome users of 'zero day' security flaw - PRESSTV

Google has issued its urgent upgrade warning and alerted all Google users about a new ‘zero-day exploit that has been found in the Chrome browser. The vulnerability is tracked as CVE-2021-30554 and being found in WebGL, a JavaScript API for rendering. The company is recommending users upgrade to 91.0.4472.114 or above immediately. Google also confirmed that three other ‘High’ level threats are patched in this version of Chrome.

See the full report here: https://www.presstv.com/Detail/2021/06/20/660502/Google-Chrome-security-flaw-warning-users-vulnerability-hackers

Adware, fake apps and banking trojans targeting Android devices - SecurityBrief New Zealand

According to new research from digital security firm Avast, Adware continues to be the most significant threat on Android phones and tablets. Adware displays intrusive ads and lures users into downloading the adware by posing as legitimate apps. Nowadays, since the pandemic hit, smartphones and devices are used daily and attackers are taking advantage by sending Mobile malware, and adware to cause a severe security risk to the user.

See the full report here: https://securitybrief.co.nz/story/adware-fake-apps-and-banking-trojans-targeting-android-devices

Fertility clinic discloses data breach exposing patient info

A Georgia-based fertility clinic has disclosed a data breach after files containing sensitive patient information of approximately 38,000 patients were stolen during a ransomware attack. The clinic has regained access to the encrypted files and a confirmation from the actor that all exposed data was deleted and is no longer in its possession. It is now advisable that patients should be on the lookout for suspicious emails and SMS texts and monitor their credit reports for fraudulent activity.

See the full report here: https://www.bleepingcomputer.com/news/security/fertility-clinic-discloses-data-breach-exposing-patient-info/

ADATA suffers 700 GB data leak in Ragnar Locker ransomware attack

The Ragnar Locker ransomware gang has published on their leak site the download links to a new set of corporate documents from Taiwanese memory and storage chip maker ADATA. A set of 13 archives, containing sensitive ADATA files, have been publicly available at a cloud-based storage service. The ransomware attack on ADATA happened on May 23rd, 2021, forcing them to take systems offline. The recently leaked batch of archives is the second one that Ragnar Locker ransomware publishes for ADATA. The previous one was posted earlier this month and includes four small 7-zip archives.

See the full report here: https://www.bleepingcomputer.com/news/security/adata-suffers-700-gb-data-leak-in-ragnar-locker-ransomware-attack/

Bugs in NVIDIA's Jetson Chipset Opens Door to DoS Attacks, Data Theft - Threatpost

NVIDIA released patches addressing nine high-severity vulnerabilities including eight additional bugs of less severity. The patches fix a wide swath of NVIDIA’s chipsets typically used for embedded computing systems, machine-learning applications, and autonomous devices such as robots and drones. Oblivious transfer extensions (OTE) are low-level cryptographic algorithms used by Jetson chipsets to process private-set-intersection protocols used to secure data as the chip processes data. The Jetson driver contains a vulnerability in the NVIDIA OTE protocol message parsing code. Flaws impacting millions of internet of things (IoT) devices running NVIDIA’s Jetson chips open the door for a variety of hacks, including denial-of-service (DoS) attacks or the siphoning of data.

See the full report here: https://threatpost.com/nvidia-jetson-chipset-dos-data-theft/167093/

Tor Browser fixes vulnerability that tracks you using installed apps

JavaScript fingerprinting firm FingerprintJS disclosed a scheme flooding vulnerability that allows the tracking of users across different browsers based on the applications installed on their device. As this vulnerability tracks users across browsers, it could allow websites, and even law enforcement, to track a user's real IP address when they switch to a different browser. The Tor Project has released Tor Browser 10.0.18 to fix numerous bugs, including a vulnerability that allows sites to track users by fingerprinting the applications installed on their devices.

See the full report here: https://www.bleepingcomputer.com/news/security/tor-browser-fixes-vulnerability-that-tracks-you-using-installed-apps/

Data leak marketplace pressures victims by emailing competitors

The data sold on dedicated data-theft extortion marketplaces are obtained through the marketplace's attacks, from other threat actors, or by collecting data released in other attacks, such as ransomware or website data breaches. One of these marketplaces, known as Marketo is applying maximum pressure on victims by emailing their competitors and offering sample packs of the stolen data. In April, Marketo claimed to have breached a large, heavy machinery and defense technology company and began selling their stolen data.

See the full report here: https://www.bleepingcomputer.com/news/security/data-leak-marketplace-pressures-victims-by-emailing-competitors/

This strange malware stops you from visiting pirate websites

Sophos researchers said they had uncovered a malware campaign that doesn't follow typical behavioral patterns of malware. Instead of seeking to steal passwords or to extort a computer’s owner for ransom, this new strain has odd intentions to block infected users’ computers from being able to visit a large number of websites dedicated to software piracy by modifying the HOSTS file on the infected system. The malware creator has used the names of numerous software brands, games, productivity tools, and cybersecurity solutions to hide the malware and so appears to be targeting everyone from gamers to professionals who might not want to purchase a software license.

See the full report here: https://www.zdnet.com/article/this-strange-malware-stops-you-from-visiting-pirate-websites/

DroidMorph tool generates Android Malware Clones that

A group of researchers from Adana Science and Technology University and the National University of Science and Technology has developed a tool dubbed DroidMorph that provides morphing of Android applications (APKs) and allows for the creation of Android apps (malware/benign) clones. The experts demonstrated that using the tool it is possible to bypass the Android anti-malware solutions performing permutations of the malware. DroidMorph first decompiles an Android APK to an intermediate form, then it carries out morphing at different levels of abstractions on it.

See the full report here: https://securityaffairs.co/wordpress/119206/malware/droidmorph-tool-generates-android-malware-clones-that.html?utm_source=rss&utm_medium=rss&utm_campaign=droidmorph-tool-generates-android-malware-clones-that

Zero-encryption zero-day – Android fitness app caught sending data in clear text - The Daily Swig

An Android fitness app, VeryFitPro, is transmitting sensitive information in clear text, potentially leaving passwords and other sensitive data exposed as a result. VeryFitPro mobile application performs all communication with the backend API via cleartext HTTP and this lack of encryption could lead to eavesdropping and interception. The current (3.3.0) version of the Android app and still sends the data via plain HTTP without encryption as confirmed by researchers.

See the full report here: https://portswigger.net/daily-swig/zero-encryption-zero-day-android-fitness-app-caught-sending-data-in-clear-text

Sophos uncovers unusual malware targeting users of pirated software - SecurityBrief Asia

Sophos published new research based on an unusual cyberattack campaign that targets users of pirated software with malware designed to block access to websites hosting pirated software. The malware is disguised as cracked versions of popular online games, such as Minecraft and Among Us, as well as productivity tools like Microsoft Office, security software, and others. Once installed, the malware blocks the victim's access to a long list of websites, including many that distribute pirated software.

See the full report here: https://itbrief.co.nz/story/sophos-uncovers-unusual-malware-targeting-users-of-pirated-software

Fake Google ads used to lure victims to malware-rigged Signal, Telegram websites - TechRadar

Cybercriminals are using malicious Google Ads and web pages to lure unsuspecting users into downloading and executing information-stealing malware. It is recommended by researchers that corporate internal security teams and external security teams need to make sure employees are very aware of the different tactics threat actors are using to lure them to malicious web pages, malicious ads, and malicious documents.

See the full report here: https://www.techradar.com/news/fake-google-ads-used-to-lure-victims-to-malware-rigged-signal-telegram-websites

Hacker attempted to taint San Francisco drinking water: report - Fox Business

According to a report by Northern California Regional Intelligence Center, a hacker attempted to taint the drinking water in the San Francisco area at the beginning of the year. The hacker obtained a former employee’s TeamViewer credentials to log on and delete programs to treat drinking water. The hack was discovered the next day and there were no failures as a result of the breach, according to the outlet.

See the full report here: https://www.foxbusiness.com/lifestyle/hacker-attempted-to-taint-san-francisco-drinking-water

New Cybercrime Prevention Act Would Shore Up Tools to Fight Hackers - MSSP Alert

A bipartisan group of senators has reintroduced the International Cybercrime Prevention Act, which would give prosecutors new tools to fight cybercriminals. The measure would create stricter criminal consequences for hackers targeting critical infrastructure and sensitive data. The officials believed that this 'Act' will strengthen the defense against hackers and foreign adversaries.

See the full report here: https://www.msspalert.com/cybersecurity-markets/americas/international-cybercrime-prevention-act/

Zephyr RTOS fixes Bluetooth bugs that may lead to code execution - BleepingComputer

The Zephyr real-time operating system (RTOS) for embedded devices received an update earlier this month that fixes multiple vulnerabilities that can cause a denial-of-service (DoS) condition and potentially lead to remote code execution. The flaws are all in the Bluetooth LE Link Layer and the L2CAP implementation. Most of them affect Zephyr versions 2.5.0 and 2.4.0 and some are also present in version 1.14. Users are advised to update to Zephyr version, 2.6.0 to mitigate the vulnerabilities.

See the full report here: https://www.bleepingcomputer.com/news/security/zephyr-rtos-fixes-bluetooth-bugs-that-may-lead-to-code-execution/

Malicious PyPI packages hijack dev devices to mine cryptocurrency - BleepingComputer

This week, multiple malicious packages were caught in the PyPI repository for Python projects that turned developers' workstations into crypto mining machines. All malicious packages were published by the same account and tricked developers into downloading them thousands of times by using misspelled names of legitimate Python projects. Each of these packages contains a malicious code in the setup.py file which is a build script that runs during a package’s installation. The script then executes a crypto mining program on the compromised machine.

See the full report here: https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-hijack-dev-devices-to-mine-cryptocurrency/

Lexmark Printers Open to Arbitrary Code-Execution Zero-Day

Lexmark printers have an unpatched vulnerability that could lead to serious, easy-to-execute attacks that require neither privileges nor user interaction and which can lead to remote code execution. The bug, found in the Lexmark Printer Software G2 Installation Package, is caused by an unquoted service-path vulnerability in the “LM__bdsvc” service. That package allows an administrator to customize the users’ installation experience. The company is yet to release a fix to address the vulnerability.

See the full report here: https://threatpost.com/lexmark-printers-code-execution-zero-day/167111/

Uninstall these eight apps with Joker malware immediately! - MENAFN.COM

The infamous Joker trojan is back to haunt Android devices. Eight applications like Auxiliary Message, Fast Magic SMS, Free CamScanner, Super Message, Element Scanner, Go Messages, Travel Wallpapers, and Super SMS that were known to be spreading the malware have since been removed from the Google Play Store.The Joker malware steals information about an Android device owner via SMS messages, stored contacts, and the device information page in Settings. It uses these details to subscribe to premium services that drain the victim's bank account.

See the full report here: https://menafn.com/1102329758/Uninstall-these-eight-apps-with-Joker-malware-immediately

Fashion firm French Connection says 'FCUK' as REvil-linked breach sees company data stolen

Cheeky clothing firm French Connection, also known as FCUK, has become the latest victim of a ransomware attack. The attack is being linked to the REvil ransomware group. The attackers penetrated its back-end and stole internal company data. The leaked information included Passport and identification card scans of staff members - including founder and chief executive Marks, chief financial officer Lee Williams, and chief operating officer Neil Williams.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2021/06/24/french_connection_says_fcuk_as/

Critical Palo Alto Cyber-Defense Bug Allows Remote ‘War Room’ Access

A critical security bug in Palo Alto Networks’ Cortex XSOAR could allow remote attackers to run commands and automation in the Cortex XSOAR War Room and to take other actions on the platform, without having to log in. Found internally by Palo Alto, the bug (CVE-2021-3044) is an improper-authorization vulnerability that enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. Users are advised to update to the latest version and revoke all active integration API keys to fully mitigate the impact of the issue.

See the full report here: https://threatpost.com/critical-palo-alto-bug-remote-war-room/167169/

Tulsa warns of data breach after Conti ransomware leaks police citations - BleepingComputer

The City of Tulsa, Oklahoma, is warning residents that their personal data may have been exposed after a ransomware gang published police citations online. In early May, Tulsa suffered a ransomware attack that led to the City shutting down its network to prevent the spread of the malware. The attack disrupted Tulsa's online bill payment systems, utility billing, and email, as well as the websites for the City of Tulsa, the Tulsa City Council, Tulsa Police, and the Tulsa 311. Yesterday, the Conti Ransomware gang has claimed responsibility and published 18,938 of the City's files, mainly police citations and internal Word documents.

See the full report here: https://www.bleepingcomputer.com/news/security/tulsa-warns-of-data-breach-after-conti-ransomware-leaks-police-citations/

VMware fixes authentication bypass in Carbon Black App Control - BleepingComputer

VMware Carbon Black App Control has been updated this week to fix a critical-severity vulnerability that allows access to the server without authentication. Tracked as CVE-2021-21998, the vulnerability is an authentication bypass affecting VMware Carbon Black App Control (AppC) versions 8.0, 8.1, 8.5 before 8.5.8, and 8.6 before 8.6.2. The severity score for the vulnerability has been calculated to 9.4, making it a critical issue that users and administrators should prioritize. There are no workarounds available, and fixing the issue is possible by installing the hotfix available for AppC 8.1.x and 8.0.x, or updating to version 8.6.2 or 8.5.8 of the product.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-authentication-bypass-in-carbon-black-app-control/

Healthcare giant Grupo Fleury hit by REvil ransomware attack - BleepingComputer

Brazilian medical diagnostic company Grupo Fleury has suffered a ransomware attack that has disrupted business operations after the company took its systems offline. With their systems shut down, business operations are disrupted, and patients are unable to schedule lab tests or other clinical exams online. Grupo Fleury has not officially confirmed a ransomware attack. However, multiple cybersecurity sources suspecting an attack by the ransomware operation known as REvil, also known as Sodinokibi.

See the full report here: https://www.bleepingcomputer.com/news/security/healthcare-giant-grupo-fleury-hit-by-revil-ransomware-attack/