𝐒𝐢𝐧𝐠𝐢𝐧𝐠 𝐑𝐢𝐯𝐞𝐫 𝐇𝐞𝐚𝐥𝐭𝐡 𝐒𝐲𝐬𝐭𝐞𝐦: 𝐁𝐞𝐭𝐰𝐞𝐞𝐧 𝐑𝐚𝐧𝐬𝐨𝐦𝐰𝐚𝐫𝐞, 𝐋𝐞𝐠𝐚𝐥 𝐃𝐢𝐬𝐩𝐮𝐭𝐞𝐬, 𝐚𝐧𝐝 𝐑𝐞𝐜𝐮𝐫𝐫𝐢𝐧𝐠 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬

Just over two years after the devastating ransomware attack attributed to the Rhysida group, Singing River Health System (SRHS) has once again fallen victim to cybercrime. This time, the Anubis ransomware group has claimed responsibility for compromising the healthcare organization’s IT systems, stating that it stole sensitive data belonging to patients and employees before encrypting the infrastructure.

https://www.suspectfile.com/singing-river-health-system-between-ransomware-legal-disputes-and-recurring-vulnerabilities/

#Anubis #Data_Breach #HIPAA #PII #PHI #Ransomware #Rhysida #Singing #SRHS

[RHYSIDA] - Ransomware Victim: IDS Group - https://www.redpacketsecurity.com/rhysida-ransomware-victim-ids-group/

#rhysida #dark_web #data_breach #OSINT #ransomware #threatintel #tor

Exposing Fox Tempest: A malware-signing service operation

Fox Tempest is a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) business used by cybercriminals to distribute malicious code, including ransomware. The actor abuses Microsoft Artifact Signing to generate fraudulent code-signing certificates, allowing malware to evade security controls. Fox Tempest created over a thousand certificates and established hundreds of Azure tenants to support operations. Microsoft revoked over one thousand certificates and disrupted the service in May 2026 through the Digital Crimes Unit. The operation enabled ransomware deployment including Rhysida by threat actors like Vanilla Tempest, and distributed malware families including Oyster, Lumma Stealer, and Vidar. The MSaaS was available through signspace[.]cloud, charging between $5000-$9000 USD. Attacks impacted healthcare, education, government, and financial services sectors globally.

Pulse ID: 6a0ca3690196d40952527b96
Pulse Link: https://otx.alienvault.com/pulse/6a0ca3690196d40952527b96
Pulse Author: AlienVault
Created: 2026-05-19 17:52:41

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Azure #Cloud #CyberSecurity #Education #Government #Healthcare #InfoSec #LummaStealer #Malware #Microsoft #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Vidar #bot #AlienVault

[RHYSIDA] - Ransomware Victim: Landeshauptstadt Stuttgart - https://www.redpacketsecurity.com/rhysida-ransomware-victim-landeshauptstadt-stuttgart/

#rhysida #dark_web #data_breach #OSINT #ransomware #threatintel #tor

[RHYSIDA] - Ransomware Victim: Tower View Primary School - https://www.redpacketsecurity.com/rhysida-ransomware-victim-tower-view-primary-school/

#rhysida #dark_web #data_breach #OSINT #ransomware #threatintel #tor