Third-party attacks emerged as a significant driver of material financial losses from cyber incidents in 2024, according to cyber risk management firm Resilience.

Third-party risks made up 31% of all client insurance claims and 23% of material losses last year. This marks a significant change from 2023, when no third-party claims led to material losses for Resilience clients.

“This shift underscores the growing vulnerabilities created by interconnected systems and reliance on external vendors in 2023,” the firm wrote in a report dated February 27.

Ransomware the Biggest Cause of Losses

Ransomware attacks targeting vendors made up 42% of the third-party claims, with losses from these incidents rising four-fold compared to 2023. The attack on automotive software firm CDK, which impacted thousands of car dealerships across the US and Canada, is an example of a ransomware attack on a vendor that financially impacts customers.

Vendor security failings, including the CrowdStrike global outage in July 2024, made up 4% of all material claims. Not all the claims arising from this incident have been fully developed, Resilience noted.

The company said that this trend is driving insurance companies to adjust their underwriting practices regarding third-party risk.

Overall, ransomware held its position as the top cause of material losses for businesses from 2023 to 2024. First-party ransomware incidents made up 44% of client ‘s material claims, while ransomware targeting vendors contributed to 18% of such claims.

Altogether, 62% of claims with losses were related to ransomware.

Despite these figures, the researchers noted that there are indications that ransomware frequency may be declining in broader markets.

“This is likely due to threat actors focusing on larger, high-profile organizations that yield bigger payouts, as opposed to the previous “spray and prey” approach,” they said.

Phishing Claims Fall Significantly

Phishing-related cyber incidents made up 9% of incurred claims in 2024, representing a 55% fall compared to 2023.

The researchers believe this trend is a reflection of improvements in phishing defenses and the shift towards third-party attacks.

There was a marked increase in transfer fraud claims, making up 18% of claims in 2024 compared to 14% in 2023.

Transfer fraud is where a scammer tricks a person into transferring them money using psychological manipulation. Resilience said it has observed scammers’ use of AI to scale such social engineering campaigns, resulting in increased susceptibility and higher success rates.

“As transfer fraud continues to grow, organizations must strengthen internal controls, educate employees on fraud prevention, and implement more robust verification processes for financial transactions,” the firm commented.

Netherlands-based threat intelligence firm Prodaft revealed on February 20 that internal chatlogs from the BlackBasta ransomware gang have been leaked online.

BlackBasta is a ransomware strain that was first detected in April 2022. Early on, cyber threat intelligence experts assessed that the members of the group behind the ransomware were associated with other top-tier ransomware groups, especially Conti and REvil.

Yelisey Bohuslavskiy, Partner and Chief Research Officer at Red Sense, believes BlackBasta is a merger of the two defunct groups.

BlackBasta Internal Chat Logs Likely Legitimate

The leaked internal chat logs, purportedly from the BlackBasta ransomware group’s Matrix server, were initially posted on file sharing site MEGA by an individual calling themselves ExploitWhispers.

The files are now accessible via a dedicated Telegram channel after their removal from the original platform.

BlackBasta’s internal chats just got exposed, proving once again that cybercriminals are their own worst enemies. Keep burning our intelligence sources, we don’t mind. 😉 pic.twitter.com/6So7dl7xXn

— PRODAFT (@PRODAFT) February 20, 2025

The source of the leak remains unclear. The identity and motives of ExploitWhispers are unknown.

The leaks, which several threat intelligence sources told Infosecurity are likely legitimate, contain “highly useful information from a threat intelligence perspective,” according to Prodaft.

The logs contain 196,045 messages, all in Russian. They include internal messages spanning from September 18, 2023, to September 28, 2024, with details on the relationships between key threat actors, the group’s access to internal networks, as well as other significant information that provides deeper insight into the group’s operations.

Internal Conflict Causes BalckBasta’s Disbanding

One of the most active ransomware groups in early 2024, BalckBasta’s operations significantly reduced in the summer. This summer lull is typical for the group however their activity has never reached previous highs – bar October 2024 – since and BlackBasta claimed almost no attacks in 2025.

One week before the leaks several threat intelligence analysts, including Red Sense’s Bohuslavskiy, assessed that BlackBasta had disbanded.

According to Prodaft, the leaks revealed that the group has been mostly inactive this year due to internal conflicts, primarily caused by a key player in the ransomware syndicate known as ‘Tramp’ or ‘Trump.’

“Tramp was responsible for distributing Qbot and managing a spamming network, which led to major disputes within the team. As a result, several key members have left,” a Prodaft spokesperson told Infosecurity.

A Prodaft researcher known as @3xp0rt on social media also explained that BlackBasta was facing several internal and external pressures.

Internally, it seems that the alleged leader, Oleg Nefedov (aka ‘Tramp’ or ‘Trump’) prioritized his own financial gain, creating a toxic environment. An administrator named ‘Lapa’ is said to be overworked, underpaid and verbally abused, while another administrator known as ‘YY’ receives better compensation.

Externally, BlackBasta conducted a risky brute-force attack on Russian banks, which may provoke a reaction from authorities. This attack also caused ‘Cortes,’ associated with the Qakbot group, to distance himself from BlackBasta.

BlackBasta Members Join Cactus and Akira Ransomware Groups

The leaks also confirmed a possible link between some BlackBasta operators and the Akira ransomware syndicate, whose activity seemed to have picked up exactly when BlackBasta’s operation was easing.

“We can confirm that a number of BlackBasta operators—many of whom were originally part of the ex-Conti cluster—have migrated to both Cactus ransomware and Akira ransomware,” the Prodaft spokesperson said.

“This shift aligns with broader trends in the ransomware ecosystem, where operators frequently move between groups as internal disputes arise or financial incentives change,” Prodaft added.

The images illustrating this article were generated using Shutterstock AI Image Generator.

Chinese state-sponsored hackers, Salt Typhoon, used the JumbledPath utility in their attacks against US telecommunication providers to stealthily monitor network traffic and potentially steal sensitive data, a new Cisco report revealed.

In the report published by Cisco Talos on February 20, the researchers confirmed Salt Typhoon gained access to core networking infrastructure through Cisco devices and then used that infrastructure to collect a variety of information.

The typical approach of Salt Typhoon to gain initial access to Cisco devices was through the threat actor obtaining legitimate victim login credentials using living-off-the-land (LOTL) techniques on network devices.

One of the main revelations of the report was that Salt Typhoon used JumbledPath, a custom-built utility allowing the threat actor to execute a packet capture on a remote Cisco device through an actor-defined jump host.

Salt Typhoon Techniques, Tactics and Procedures

According to Cisco Talos, Salt Typhoon used stolen credentials and actively tried to steal more by targeting weak password storage, network device configurations and capturing authentication traffic.

The group stole device configurations, often via TFTP/FTP, to gain access to sensitive information like SNMP strings and weakly encrypted passwords, which could then be easily decrypted, and to understand network topology for further attacks.

JumbledPath, a utility written in Go and compiled as an ELF binary using an x86-64 architecture, was found in actor-configured Guest Shell instances on Cisco Nexus devices.

Guest Shell is a Linux-based virtual environment that runs on Cisco devices and allows users to execute Linux commands and utilities.

It was used to modify network device configurations, attempt to clear logs, impair logging along the jump path and return the resultant compressed, encrypted capture via another unique series of actor-defined connections or jumps.

“This allowed the threat actor to create a chain of connections and perform the capture on a remote device,” the Talos researchers said.

“The use of this utility would help to obfuscate the original source, and ultimate destination, of the request and would also allow its operator to move through potentially otherwise non-publicly-reachable (or routable) devices or infrastructure.”

The group then moved laterally within compromised networks and between different telecom providers, using compromised devices as stepping stones to reach other targets and avoid detection.

Finally, the threat actor repeatedly cleared relevant logs to obfuscate their activities, including .bash_history, auth.log, lastlog, wtmp, and btmp, where applicable. In many cases, shell access was restored to a normal state by using the “guestshell disable” command.

The threat actor modified authentication, authorization and accounting (AAA) server settings with supplemental addresses under their control to bypass access control systems.

Cisco Vulnerability Exploit Unrelated to Salt Typhoon

During their investigations, the Talos researchers found additional targeting of Cisco devices with the abuse of CVE-2018-0171, a legacy vulnerability in the Smart Install (SMI) feature of Cisco IOS and Cisco IOS XE software.

However, the researchers noted that this activity appears to be unrelated to the Salt Typhoon operations.

“We have not yet been able to attribute it to a specific actor. The IP addresses provided as observables below are associated with this potentially unrelated SMI activity,” they added.

Salt Typhoon Mitigation Recommendations

Following their investigations, the Talos researchers provided a list of Cisco-specific security threat mitigation recommendations. These include:

• Disabling the underlying non-encrypted web server using the “no ip http server” command. If web management is not required, disable all of the underlying web servers using “no ip http server” and “no ip http secure-server” commands
• Disabling telnet and ensuring it is not available on any of the Virtual Teletype (VTY) lines on Cisco devices by configuring all VTY stanzas with “transport input ssh” and “transport output none.”
• Disabling the guestshell access (if not necessary) using “guestshell disable” for those versions which support the guestshell service
• Disabling Cisco’s Smart Install service using “no vstack”
• Using type 8 passwords for local account credential configuration
• Using type 6 for TACACS+ key configuration

The images illustrating this article were generated using Shutterstock AI Image Generator.

A new malware campaign targeting freelance developers has been using deceptive job advertisements to trick them into downloading malicious software disguised as legitimate tools.

The campaign primarily spreads through GitHub repositories and relies on freelancers’ eagerness to secure remote work opportunities.

The attackers pose as reputable companies, offering freelance developers attractive job opportunities. To make their deception convincing, they set up fake websites and distribute malicious software under the guise of professional development tools.

Once downloaded, the malware can compromise the victim’s system, allowing attackers to steal credentials or install additional payloads.

ESET researchers have linked the campaign to a threat actor they call “DeceptiveDevelopment.” The group specializes in targeting freelance platforms and coding communities to spread malware. Victims are often directed to GitHub, where malicious repositories host tools laden with hidden threats.

“DeceptiveDevelopment was first publicly described by Phylum and Unit 42 in 2023 and has already been partially documented under the names Contagious Interview and DEV#POPPER,” ESET wrote.

“We have conducted further analysis of this activity cluster and its operator’s initial access methods, network infrastructure, and toolset, including new versions of the two malware families used by DeceptiveDevelopment – InvisibleFerret and […] BeaverTail.”

The malware uses various techniques to evade detection and persist on compromised systems. ESET noted that it collects sensitive information, including saved login credentials, and can deliver additional malware payloads remotely.

Read more on how threat actors target jobseekers: Lazarus Group Targets Bitdefender Researcher with LinkedIn Recruiting Scam

Developers are advised to exercise caution when applying for freelance opportunities online. Verifying job offers and researching potential employers can help mitigate risks.

Experts also recommend avoiding downloads from unfamiliar GitHub repositories and keeping systems updated with robust security software.

“The DeceptiveDevelopment cluster is an addition to an already large collection of money-making schemes employed by North Korea-aligned actors and conforms to an ongoing trend of shifting focus from traditional money to cryptocurrencies,” ESET explained.

“We observed it go from primitive tools and techniques to more advanced and capable malware, as well as more polished techniques to lure in victims and deploy the malware. Any online job-hunting and freelancing platform can be at risk of being abused for malware distribution by fake recruiters.”

As freelance work continues to grow, threat actors are likely to exploit this evolving ecosystem. Developers and companies alike must implement stronger protections to defend against such targeted threats.