FlagThis

The Ghost (Cring) ransomware group, known for exploiting vulnerabilities in software and firmware, remains a significant threat as of January 2025. A joint cybersecurity alert from the FBI, CISA, and other partners warns the global cyber defender community of increasing attacks from this financially motivated group. CISA issued a joint advisory on February 19, 2025, emphasizing the group's ongoing activity.

The Ghost (Cring) ransomware first appeared in early 2021 and has impacted organizations across more than 70 countries by compromising vulnerable, internet-facing services. Security measures such as patching known vulnerabilities and implementing basic infosec actions are crucial in defending against these attacks. The SOC Prime Platform has curated Sigma rules to help detect Ghost (Cring) ransomware activity.

ImgSrc: www.tenable.com

References :

• SecureWorld News: The FBI, CISA, and MS-ISAC have issued a joint cybersecurity advisory warning organizations about Ghost (Cring) ransomware, a sophisticated cyber threat that has been compromising critical infrastructure, businesses, and government entities worldwide.
• Tenable Blog: Rapid7 discusses Ghost Ransomware group targeting known Vulns.
• aboutdfir.com: The operators of Ghost ransomware continue to claim victims and score payments, but keeping the crooks at bay is possible by patching known vulnerabilities and some basic infosec actions.
• Resources-2: Picus Security provides Ghost (Cring) Ransomware Analysis, Simulation, and Mitigation.
• socprime.com: Ghost (Cring) Ransomware Detection: The FBI, CISA, and Partners Warn of Increasing China-Backed Group’s Attacks for Financial Gain
• SOC Prime Blog: The FBI, CISA, and partners have recently issued a joint cybersecurity alert warning the global cyber defender community of increasing Ghost (Cring) ransomware attacks aimed at financial gain.
• thecyberexpress.com: A Ghost ransomware group also referred to as Cring, has been actively exploiting vulnerabilities in software and firmware as recently as January 2025.
• Security Boulevard: [CISA AA25-050A] #StopRansomware: Ghost (Cring) Ransomware
• www.attackiq.com: CISA AA25-050A] #StopRansomware: Ghost (Cring) Ransomware
• industrialcyber.co: CISA, FBI, MS-ISAC warn of Ghost ransomware
• aboutdfir.com: The operators of Ghost ransomware continue to claim victims and score payments, but keeping the crooks at bay is possible by patching known vulnerabilities and some basic infosec actions, according to a joint advisory issued Wednesday by the FBI and US Cybersecurity and
• securebulletin.com: Secure Bulletin provides an analysis of tactics, targets, and techniques used by Ghost Ransomware.
• Secure Bulletin: Securebulletin article on Ghost Ransomware
• The Register - Security: Ghost ransomware crew continues to haunt IT depts with scarily bad infosec
• cyble.com: FBI-CISA Ghost Ransomware Warning Shows Staying Power of Old Vulnerabilities
• aboutdfir.com: News article covering the joint advisory from CISA and the FBI on the Ghost/Cring ransomware.

Classification:

• HashTags: #ransomware #cybersecurity #Ghost
• Target: Organizations Globally
• Attacker: Ghost
• Feature: Exploiting Unpatched Vulnerabi
• Malware: Ghost
• Type: Ransomware
• Severity: Major