Ontario security company uncovers ransomware gang affiliate using Cobalt Strike

Advertisement

Advertise with us

TORONTO - An Ontario security software company says it has discovered a new affiliate of a ransomware gang that has pledged allegiance to Russia carrying out attacks with threat emulation technology.

Read this article for free:


By clicking the button above, an account will be created and you will begin to receive some of our recommended newsletters. You may opt out of any newsletter by visiting your Email and Communication Preferences page or by clicking "unsubscribe" at the bottom of any email.

or

Already have an account? Log in here »

To continue reading, please subscribe:

Digital Subscription

One year of digital access for only $1.44 a week*

  • Enjoy unlimited reading on winnipegfreepress.com
  • Read the E-Edition, our digital replica newspaper
  • Access News Break, our award-winning app
  • Play interactive puzzles

*Billed as $5.77 plus GST every four weeks. After 52 weeks, price increases to the regular rate of $19.95 plus GST every four weeks. Offer available to new and qualified returning subscribers only. Cancel any time.

To continue reading, please subscribe:

Add Free Press access to your Brandon Sun subscription for only an additional

$1 for the first 4 weeks*

  • Enjoy unlimited reading on winnipegfreepress.com
  • Read the E-Edition, our digital replica newspaper
  • Access News Break, our award-winning app
  • Play interactive puzzles
Start now

*Your next Brandon Sun subscription payment will increase by $1.00 and you will be charged $17.95 plus GST for four weeks. After four weeks, your payment will increase to $24.95 plus GST every four weeks.

Hey there, time traveller!
This article was published 21/03/2022 (1671 days ago), so information in it may no longer be current.

TORONTO – An Ontario security software company says it has discovered a new affiliate of a ransomware gang that has pledged allegiance to Russia carrying out attacks with threat emulation technology.

Waterloo, Ont.-based eSentire says its threat response unit has been tracking an affiliate of Conti since August and discovered the group used Cobalt Strike in two attacks around Valentine’s Day, as tensions between Russia and Ukraine were escalating.

The firm calls Cobalt Strike “the Swiss army knife of cyber intrusions” because the tool can replicate and launch sophisticated cyberattacks that can test security detections, protections and response systems, but is being used by threat actors to compromise IT environments and spread throughout networks.

A woman uses a computer keyboard in North Vancouver, B.C., on Wednesday, December, 19, 2012. An Ontario security software company says it has discovered a new affiliate of a ransomware gang that has pledged allegiance to Russia carrying out attacks with threat emulation software.THE CANADIAN PRESS/Jonathan Hayward
A woman uses a computer keyboard in North Vancouver, B.C., on Wednesday, December, 19, 2012. An Ontario security software company says it has discovered a new affiliate of a ransomware gang that has pledged allegiance to Russia carrying out attacks with threat emulation software.THE CANADIAN PRESS/Jonathan Hayward

The threat response unit intercepted an attack using Cobalt Strike to try to breach an unnamed children’s charity and hours later, found it being used to target a legal firm.

It says Conti is comprised of sophisticated ransomware developers and operators known for compromising and disrupting the operations of health-care organizations, emergency services, municipalities, oil transportation and electric companies and schools.

Conti claimed responsibility for a cyberattack on a Quebec smelter Rio Tinto operates earlier this month.

This report by The Canadian Press was first published March 21, 2022.

Report Error Submit a Tip

More Stories

Violence directed at Winnipeg School Division support staff surges, union reports

Maggie Macintosh 5 minute read Preview

Violence directed at Winnipeg School Division support staff surges, union reports

Maggie Macintosh 5 minute read Updated: Yesterday at 6:46 PM CDT

Kicking, biting and other types of student aggression toward educational assistants in Winnipeg has surged 118 per cent since 2022-23.

Read
Updated: Yesterday at 6:46 PM CDT

No shame in family’s help with young one

Maureen Scurfield 4 minute read 2:01 AM CDT

DEAR MISS LONELYHEARTS: My husband hates it that I didn’t want to go back to work right after having our child. I still don’t want to farm out our sweet breastfeeding baby girl to a babysitter!

I’ve been staying home to be with her, but I just found two hidden unpaid utility bills in my husband’s truck, that could get us in very big trouble. No wonder my guy doesn’t like me going into his truck alone these days.

Now I don’t know what to do. Should I talk to my parents about borrowing money from them before we get our utilities cut off? My husband says that will make him “look bad,” like he couldn’t take care of me and our child. Well, he can’t!

— Desperate Mom, St. Boniface

Letters, Oct. 16

6 minute read Preview

Letters, Oct. 16

6 minute read Updated: Yesterday at 8:53 AM CDT

A few days ago, U.S. President Donald Trump attended a rally in Arizona. At about the same time, Pete Hoekstra, the U.S. ambassador to Canada was interviewed on The Really Big Show.

Read
Updated: Yesterday at 8:53 AM CDT

Not much of a race when most of the field can’t find their running shoes

Dan Lett 5 minute read Preview

Not much of a race when most of the field can’t find their running shoes

Dan Lett 5 minute read Yesterday at 2:52 PM CDT

In Winnipeg's mayoral race, there are few truly bad ideas, but hardly any really good ones.

Read
Yesterday at 2:52 PM CDT

Diesel bill adds to cost-price squeeze on farm

Laura Rance-Unger 4 minute read Preview

Diesel bill adds to cost-price squeeze on farm

Laura Rance-Unger 4 minute read 2:01 AM CDT

Blessed with a week of good weather, most Manitoba farmers are now in the home stretch of harvest and beginning to assess whether their crop will earn enough to cover the cost of growing it.

Commodity market prices have surged well above the numbers used to prepare production budgets earlier this year, with the price of top-quality milling wheat up 27 per cent over a year ago. Canola and soybeans are up 36 per cent and oats by 14 per cent.

That’s a significant boost for the crops harvested in good shape before rainy weather shut down operations for a couple of weeks during the critical harvesting window. However, upwards of half of the province’s crop overall was affected by the bad weather, resulting in yet-to-be calculated yield and quality losses.

Then there’s the cost side of the balance sheet.

Read
2:01 AM CDT

The threat from outside Canada

Dan Lett 4 minute read Preview

The threat from outside Canada

Dan Lett 4 minute read 2:01 AM CDT

The 10-question referendum being held in Alberta on Monday, Oct. 19, is not the first time the unity of Canada has been threatened by a vote within one province. It is, however, the first referendum of this type to take place in an age of unfettered social media misinformation and deliberate foreign interference.

From mischievous comments by U.S. President Donald Trump about making Canada the 51st state to technology trillionaire Elon Musk’s urgings to Quebec and Alberta to separate, there are clear signs foreign interests are trying to influence Monday’s vote. But there are also less-obvious efforts at work to influence the referendum and destabilize Canada.

The Canadian Security Intelligence Service (CSIS) and independent think-tanks such as the Centre for Artificial Intelligence, Data and Conflict at the University of Regina have documented incidents involving Russian-linked automated content farms posting thousands of misleading articles about the referendum campaign on social media platforms. The content, CSIS has said, focuses on erroneous claims about the benefits of separation and the liabilities of remaining in Canada.

In the face of all that activity, Prime Minister Mark Carney has been alarmingly unconcerned. Campaigning in Alberta this week, Carney said Ottawa is closely monitoring disinformation campaigns. He added that, in his conversations with foreign governments, all have agreed to stand down from any activities that might be perceived as threats to democracy.

Read
2:01 AM CDT