- The FBI has issued a warning about a Chinese ransomware group called Ghost.
- Ghost has attacked critical infrastructure, schools, and businesses in over 70 countries.
- The FBI advises using security updates and multifactor authentication to prevent ransomware attacks.
The FBI is warning about a new ransomware hacker group called “Ghost.”
The FBI published a security advisory with the Cybersecurity and Infrastructure Agency that said the group began indiscriminately attacking organizations in more than 70 countries starting in 2021. The warning from the FBI and the CISA says Ghost is now one of the top ransomware groups, targeting organizations all over the world as recently as January.
“Ghost actors, located in China, conduct these widespread attacks for financial gain,” the report says. “Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.”
Ransomware is a type of malware that lets bad actors encrypt a victim’s data until they pay a ransom. Ransomware attacks have become more common in recent years, sometimes targeting large companies or government infrastructure.
A ransomware attack in February 2024 against Chain Healthcare, the payment arm of healthcare giant UnitedHealth Group, briefly crippled the pharmacy industry after it caused a major backlog in filling customer subscriptions.
Most ransomware hackers use phishing methods, sending fake messages to victims in the hope that they’ll click a link and install malware on their devices.
The hackers in the Ghost group, however, use publicly available code to exploit common vulnerabilities in organizations’ software that have not been removed by updated patches, the FBI says.
“The FBI has observed Ghost actors obtaining initial access to networks by exploiting public-facing applications that are associated with multiple Common Vulnerabilities and Exposures,” the warning says.
The FBI said in the warning that Ghost attackers usually claim that they will sell the victim’s stolen data if they do not pay a ransom. However, the agency said they “do not frequently exfiltrate a significant amount of information or files, such as intellectual property or personally identifiable information that would cause significant harm to victims if leaked.”
The FBI recommends consulting its StopRansomware guide for comprehensive information on how companies can guard against ransomware attacks.
Some tips for fighting against common ransomware tactics are to maintain regular system backups of sensitive information, patch known system vulnerabilities with security updates and use phishing-resistant multifactor authentication for company email accounts.
The FBI recommends reporting any ransomware attacks to the agency. In the security advisory, the FBI said it is particularly interested in “any information that can be shared, including logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, and/or decryptor files.”
