Accessibility links

Facebook   X   LinkedIn   Email

No Organization is Safe from Ghost Ransomware

By: Jim Stickley and Tina Davis
May 11, 2025

Both the FBI and CISA (Cybersecurity and Infrastructure Security Agency) recently released a warning about a ransomware group called Ghost. This Chinese state-sponsored threat group means business, targeting everything from critical infrastructure and schools to healthcare and religious organizations. They also warn no organization of any kind is safe from Ghost attacks. Here’s what you need to know, now.

A Ransomware Group by Any Other Name

By changing tactics for hooking victims, Ghost is also known by a host of other names including Phantom, Cring, Strike, Rapture, Crypt3r and Hello. By whatever name, this threat group has successfully attacked organizations since 2021 and shows no end in sight.

Typically, Ghost ransomware enters an organization by exploiting CVEs (common vulnerabilities and exposures) to gain access to a system. Once inside, Ghost doesn’t stay long like other ransomware groups. These groups typically stay for weeks to months checking out different networks, planting various malware types, and deciding what information to ransom. Ghost is known to sweep into a system and deploy ransomware on the same day. 

Ghost ransom notes get sent via legitimate email services and threaten to sell a victim’s hijacked data if the ransom demand isn’t paid. The FBI says, “Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key…” Ghost actors, they warn, usually demand ransoms up to hundreds of thousands in cryptocurrency for decryption.

Keeping Ghost Away

Email phishing is one of Ghost’s tactics for entering a system. Since 91% of cybercrime gets delivered via phishing, pay special attention to its red flags. An unknown email sender or address, suspicious links and attachments and requiring sensitive PII like passwords for accounts are all email phishing red flags, as is some sense of urgency to take action.

Always keep system and other software updated with the latest security patches and bug fixes so known vulnerabilities aren’t exposed. The same goes for anti-virus software so it helps catch the latest malware threats. 

No organization wants to hear Ghost rattling its ransomware chains. So, stay alert and do all you can to prevent being the next victim.



FBI Warns Medusa is Trying to Snake Her Way Into Your Network

Your Security

FBI Warns Medusa is Trying to Snake Her Way Into Your Network

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning about a ransomware-as-a-service variant that has been on the attack since December. The Medusa ransomware, a sophisticated cyber threat that has targeted over 300 victims across critical infrastructure sectors. These include, healthcare, education, and manufacturing. The group employs tactics such as phishing campaigns and exploiting unpatched software vulnerabilities to gain unauthorized access to systems. READ FULL STORY
IRS “Dirty Dozen” Tax Scams for Season of 2024

Scams & Phishing

IRS “Dirty Dozen” Tax Scams for Season of 2024

Beginning in 2002, the IRS has released its list of the top twelve tax scams. They call it the “Dirty Dozen” campaign. Every year, the agency takes a look at the most prevalent tax scams affecting U.S. taxpayers to help keep us all safe from tax fraudsters. They also remind us that although scams increase during tax time, which is starting right about now, they still happen year-round. We’ll pick a few notable ones to explain in this article. READ FULL STORY
The Battle Persists: Ransomware Continues Targeting Hospitals

Corporate Security

The Battle Persists: Ransomware Continues Targeting Hospitals

An ongoing challenge for hospitals is keeping safe from ransomware attacks. It's a tall order, and Blackcat ransomware group is flexing its claws and choosing the next victim. In fact, three U.S. government agencies advised our healthcare systems about Blackcat's devastating attacks. It's not the first time these systems have been warned about ransomware, and it won't be the last. Before this alert, an FBI flash alert was declared in April 2022 and an advisory issued in December 2023. READ FULL STORY
Akira Ransomware Nets Attackers $42 Million

Corporate Security

Akira Ransomware Nets Attackers $42 Million

The FBI, Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre, and the Netherlands’ National Cyber Security Centre recently issued a joint statement to share critical intelligence on the Akira ransomware. The alert included Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) identified through FBI investigations and trusted third-party reporting up to February 2024. According to the statement, since March 2023, Akira ransomware has been busy impacting numerous businesses and essential infrastructure sectors across North America, Europe, and Australia. READ FULL STORY
FBI Warns of Chinese Malware on Your Home and Office Routers

Your Security

FBI Warns of Chinese Malware on Your Home and Office Routers

You may have heard that U.S. Officials testified in front of Congress recently. They noted that a hacker group from China, known as Volt Typhoon placed malware on hundreds of routers, both home and office products intending to use them for launching an attack at some point in the future against U.S. critical infrastructure. The testimony included a warning that the attackers were holding off and waiting to launch a future attack using the affected devices. But there is something we can do to prevent our own products from being abused. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.