Hi Everyone,
CISA recently published a Cybersecurity Advisory for Akira Ransomware:
The Threat Actors are gaining access to vulnerable environments via VPN which do not have multifactor authentication enabled, using known Cisco vulnerabilities, internet facing RDP access, spear phishing and valid credential abuse.
However, what is most interesting is that they are also going after Veeam Backup Servers and have created their own scripts:
Ensure:
- MFA is enabled
- Segment networks
- Patch often
- Review and audit user accounts
- Have offline and offsite backups
