Maintenance in progress

two ransomware operations restructured in the same window: storm-1175, formerly a medusa affiliate, deployed a new strain called stormencryptor against a flaw in the n-central platform managed service providers use to administer client networks, and gunra was the subject of a joint fbi, cisa, nsa and south korean advisory after shifting from encryption to full enterprise intrusion including firewall and vpn compromise and backup destruction. separately a teamcity remote-code flaw went from no known exploitation to cisa's exploited list in nine days. the pattern is affiliates re-forming around tooling that reaches many victims through one vendor.

joint government advisories and vendor telemetry