Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Drew Schmitt
BianLian GOs for PowerShell After TeamCity Exploitation
Contributors: Justin Timothy, Threat Intelligence Consultant, Gabe Renfro, DFIR Advisory Consultant, Keven Murphy, DFIR Principal Consultant Introduction Ever since Avast released a decryptor for BianLian in January 2023, the group has moved to extortion-only operations. Since this time, GuidePoint's Research and Intelligence Team (GRIT) has been keeping a close eye on BianLian's operations.
Leveraging Strategic Communications for Ransomware Response
Additional contribution to this blog from Jason Baker, Threat Intelligence Consultant If you've found this blog because you're currently experiencing a ransomware incident, reach out to the GuidePoint Research and Intelligence Team (GRIT) immediately to engage and assist with your ransomware response. Executive Summary The unfortunate reality is that far too many organizations are becoming victims of ransomware attacks.
GRIT Ransomware Report: April 2023
Additional contributors to this GRIT report: Grayson North, Nic Finn, and Drew Schmitt Following a relatively active March-resulting in 451 affected organizations observed across 24 ransomware leak sites-GRIT observed interesting movement in the ransomware landscape in April.
The GRIT Threat Feed is here
When we launched GRIT just over a year ago, it came from a desire to take all the great work GuidePoint Security's Incident Response and Threat Intelligence teams were doing-everything that we were proactively researching and working on-and share it with as many people as we could. When we're working on an incident or researching a new threat, we generate intelligence from every possible source.
GRIT Ransomware Report: February 2023
Additional contributors to this GRIT report: Grayson North, Jason Baker, and Drew Schmitt Compared to January, February showed a heavy increase in ransomware activity in reported victims and the countries affected, but overall trends in victims, group activity, and targeting remained largely the same. The most notable change was the increase in victim count by the Lockbit ransomware-as-a-service (RaaS) group.
GRIT Ransomware Report: January 2023
January kicked off 2023 with a slowdown in victim posting rates across ransomware groups. Overall, January saw a 41% decrease compared to December 2022 and a 12.9% decrease in victims compared to January of last year. Despite an 11% decrease in victims during January, Lockbit remains the most prolific ransomware group by far, with their victims totaling more than double the other top-five groups: Vice Society, AlphV, Royal, and Play.
GRIT Ransomware Report: November 2022
Report written by Drew Schmitt and Nic Finn In November, GRIT observed 22 active groups accounting for 166 victims. Continuing their trend from previous months, Lockbit's claimed victims fell by a massive margin, dropping 41% from their October haul. November represents Lockbit's slowest month this year, falling even lower than they did during their June to July lull when switching from Lockbit2 to Lockbit3.
GRIT Ransomware Report: August 2022
Ransomware Trends In August, GRIT saw a slight downward trend in total ransomware reports (from 187 to 176, a 5.88% drop), with eight groups showing a decline in reports compared to July. Specifically, six groups had a 50% or more decline in public postings including Yanlouwang, Hive, Lorenz, AlphV, Onyx, and Cuba. The Hive ransomware group was especially notable due to their drop from 26 victims in July to only 7 victims in August.
When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
Executive Summary As security practitioners, we spend a lot of time focusing on the threat actors and malware families that leverage the most impactful exploits or affect the highest number of victims. But what happens when a threat actor goes “low and slow” to fly under the radar? One could argue that, in that situation, the threat actor may end up having more impact than some of the more prolific threat groups.
When Threat Actors Fly Under the Radar: Vatet, PyXie and Defray777
This post is also available in: 日本語 (Japanese) Last, but Not Least: Defray777 Defray777 is an elusive family of ransomware also known as Ransom X and RansomExx. Although it has recently been covered in the news as a new family, it has been in use since at least 2018 and is responsible for a number of high-profile ransomware incidents -- as detailed in the articles we linked to. Defray777 runs entirely in memory, which is why there have been so few publicly discussed samples to date.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Drew
Contact Drew, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack