The Cybersecurity and Infrastructure Security Agency, the FBI and the Multi-State Information Sharing and Analysis Center have released a joint cybersecurity advisory concerning the ransomware known as Ghost.
Ghost Ransomware Activity
According to the advisory, which was issued on Wednesday, malicious actors have been using Ghost since early 2021 to target victims with internet-facing services running on outdated firmware or software. The malicious actors are located in China but their attacks have compromised the systems of organizations found in over 70 countries, including China.
Victims include critical infrastructure organizations, education institutions, manufacturing companies, government organizations and religious institutions. The purpose of the attacks is financial gain.
Contents of the Advisory
The advisory provides indicators of compromise; tactics, techniques and procedures, and detection methods associated with Ghost. The advisory also contains recommended mitigations, which organizations are encouraged to implement.
