Tag: ransomware

Hacker Group Claims UNM Hospital Cyberattack, Then Apologizes and Offers Patients $2,500

Posted on by faz_business



On Monday, University of New Mexico Health Sciences Center information technology teams identified a cybersecurity threat around 11 a.m. and began containment efforts. From 12:30 to 2:30 p.m., the health system temporarily diverted ambulance traffic to other hospitals in Albuquerque and Santa Fe, while outpatient surgeries and appointments were suspended for the remainder of the day as teams worked to protect the network. Notably, UNM Hospital is New Mexico’s only Level I trauma center.

In an update provided by the UNM Health Sciences Center the following afternoon, officials said critical electronic systems were back online. “All UNM Health hospitals are fully open, ambulance traffic has returned to normal operations, and clinics have resumed regularly scheduled appointments and procedures,” the update stated. “Their assessment determined that the event affected some end-user devices but did not penetrate core systems or servers. Teams worked with external partners to secure the network and notified state and federal law enforcement.”

Classes at the UNM School of Medicine, College of Nursing, College of Pharmacy, and College of Population Health remained canceled on Tuesday, and nonessential Health Sciences Center employees were asked to remain home. A later update added, “Classes and research activities at the UNM Health Sciences Center resumed Wednesday and clinical operations across all UNM Health facilities are fully functional.”

The incident remains under criminal investigation, which may have limited what the university has shared publicly. UNM has not described the event as a ransomware attack.

BYOD Claims Responsibility and Offers an Apology

While all of this was going on, a hacker group called BYOD also listed the University of New Mexico on its data-leak site, which operates as a Tor hidden service. The post claimed 36,000 machines were compromised across the main campus and the hospital sector, along with two Oracle databases, Oracle HR and Payroll systems, student records, internal emails, electronic health record rosters, and other data. Additionally, it claimed to have every student and employee’s personally identifiable information, including Social Security numbers.

“This is your entire network and infrastructure compromised, the entire university COMPLETELY,” the listing said, according to a republication via Dark Web Informer. “Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.”

On Tuesday, BYOD published an update offering free decryption keys for remaining locked devices in the hospital sector only. The full message read:

“We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That’s the whole reason why we came about and we plan to keep it that way.”

It is unclear whether BYOD provided any decryption assistance that contributed to the restoration of systems at the UNM Health Sciences Center. The UNM Health Sciences Center did not immediately respond to a request for comment on that point from Gizmodo at the time of publication. The university’s public statements have not confirmed the claims from BYOD, so the full extent of those claims remains unverified at this time.

The closest thing to a public statement regarding BYOD was included in a Wednesday update from UNM, which stated, “Following a cybersecurity incident, those responsible may attempt to exploit public concern through additional scams, including false offers of payments or compensation.”

The statement also claimed, “UNM did not make concessions with any group behind the threat.”

What is BYOD?

BYOD is a relatively new ransomware group that emerged roughly a month ago. According to BleepingComputer, the group’s leak site lists six victims so far, including T-Mobile, and it has already published data it claims to have stolen from three of them. The group has described its activity as a form of “pentesting” intended to expose vulnerabilities and hold data controllers accountable.

One of its earlier targets was Trump Mobile, where the group posted a database of what it claimed was 3,615 customer records. Reporters and security researchers later verified parts of the data as authentic. The leaked file contained real names, email addresses, phone numbers, physical addresses, and order details. According to International Cyber Digest, records associated with Trump Organization Chief Information Officer Eric Brunnett and U.S. Congressman Mike Kelly were included in the data. BYOD alleged the breach occurred after malware infected a device at partner company Liberty Mobile, and claimed Trump Mobile responded by saying it had no security team to handle the incident.

Public apologies and offers of free decryption keys from ransomware groups are uncommon, but they’re not completely unprecedented. In January 2023, the LockBit group formally apologized for an attack on Toronto’s Hospital for Sick Children after an affiliate violated internal rules against targeting medical institutions. LockBit stated it had blocked the affiliate and released a free decryptor. The hospital later said it had not paid a ransom and was restoring systems from backups.

Other similar instances of this kind of activity include Conti’s handling of Ireland’s Health Service Executive attack and the release of a master key by TeslaCrypt.



Canadian spy agency says it hacked drug traffickers, extremists and a ransomware gang last year

Posted on by faz_business


Offering a rare glimpse at the priorities of a top spy organization, Canada’s Communications Security Establishment said it conducted a handful of state-authorized hacks last year in order to disrupt the operations of drug traffickers, violent extremists, and a ransomware gang.

The disclosures in the Canadian intelligence agency’s annual report underscore some of the main national security threats that face Canada and its closest allies: ranging from the import of illegal drugs to cyberattacks. The spy agency, CSE, is tasked with collecting foreign intelligence, defending government systems, and disrupting online adversaries.

Published last week, the report says the CSE last year carried out three foreign “active cyber operations” — the term agency uses to describe its cyberattacks on overseas operations that threaten Canadian national security and public safety.

One of the operations, per the report, targeted cybercriminals outside of Canada who were brokering the sale of chemicals used to create the synthetic opioid, fentanyl. The CSE collected intelligence on the brokers, then conducted an operation that “disrupted and diminished their ability to operate,” the report said.

Another active operation involved the collection of signals intelligence — data produced from electronics and internet-connected devices — on an overseas extremist group that was spreading violent ideology and recruiting members, including in Canada.

The report said the agency analyzed the group’s organization, reach, and potential vulnerabilities to conduct an operation that “successfully undermined the group’s credibility and limited their ability to radicalize and recruit new members.”

Another operation involved disrupting a ransomware-as-a-service operation that let hackers rent access to a ransomware gang’s infrastructure to launch destructive extortion attacks. The CSE said its signals intelligence unit identified how the gang worked against the healthcare, transportation, and business sectors in Canada, then used an active cyber operation that “rendered the group’s infrastructure inoperable.” The operation also deleted much of the data on the gang’s servers.

The agency said it undertook concurrent “technical disruptions” against 10 of the most significant ransomware gangs targeting Canada to “make parts of their infrastructure unusable.”

The report did not say where the hackers, extremists or the ransomware gang were located, or the specifics of the operations that the CSE used to target them. It’s not uncommon for spy agencies to conduct cyberattacks against their adversaries, but such operations are seldom disclosed or detailed to protect the methods and techniques used.

Fort Meade, Maryland-based Cyber Command, which conducts cyber operations for the U.S. government, regularly carries out “hunt forward” operations that involve sending cyber teams to allied nations to secure their networks and disrupt cyber operations launched by adversaries. The number of U.S.-led hunt forward operations have risen from a few handful during 2018 to more than two dozen during 2025.

Canada’s CSE said it also carried out one defensive cyber operation during the year to target a phishing campaign aimed at Canadian federal government institutions and other important systems. The agency said it disrupted the group’s infrastructure and “degraded their ability” to target Canadians.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Cybercriminals Pose a Greater Threat of Disruptive US Election Hacks Than Russia or China

Posted on by faz_business


Russian, Chinese, and Iranian state-backed hackers have been active throughout the 2024 United States campaign season, compromising digital accounts associated with political campaigns, spreading disinformation, and probing election systems. But in a report from early October, the threat-sharing and coordination group known as the Election Infrastructure ISAC warned that cybercriminals like ransomware attackers pose a far greater risk of launching disruptive attacks than foreign espionage actors.

While state-backed actors were emboldened following Russia’s meddling in the 2016 US presidential election, the report points out that they favor intelligence-gathering and influence operations rather than disruptive attacks, which would be viewed as direct hostility against the US government. Ideologically and financially motivated actors, on the other hand, generally aim to cause disruption with hacks like ransomware or DDoS attacks.

The document was first obtained by the national security transparency nonprofit Property of the People and viewed by WIRED. The US Department of Homeland Security, which contributed to the report and distributed it, did not return WIRED’s requests for comment. The Center for Internet Security, which runs the Election Infrastructure ISAC, declined to comment.

“Since the 2022 midterm elections, financially and ideologically motivated cyber criminals have targeted US state and local government entity networks that manage or support election processes,” the alert states. “In some cases, successful ransomware attacks and a distributed denial-of-service (DDoS) attack on such infrastructure delayed election-related operations in the affected state or locality but did not compromise the integrity of voting processes … Nation-state-affiliated cyber actors have not attempted to disrupt US elections infrastructure, despite reconnaissance and occasionally acquiring access to non-voting infrastructure.”

According to DHS statistics highlighted in the report, 95 percent of “cyber threats to elections” were unsuccessful attempts by unknown actors. Two percent were unsuccessful attempts by known actors, and 3 percent were successful attempts “to gain access or cause disruption.” The report emphasizes that threat intelligence sharing and collaboration between local, state, and federal authorities help prevent breaches and mitigate the fallout of successful attacks.

In general, government-backed hackers may stoke geopolitical tension by conducting particularly aggressive digital espionage, but their activity isn’t inherently escalatory so long as they are abiding by espionage norms. Criminal hackers are bound by no such restrictions, though they can call too much attention to themselves if their attacks are too disruptive and risk a law enforcement crackdown.