Topic
12 posts
Censys research reveals 14,004 exposed healthcare devices online, risking patient data breaches. Learn how DICOM, EMR/EHR exposures threaten security and what to do.
Manufacturing leads ransomware attacks in H1 2024 with 281 victims. Learn key findings from GRF's report and how to protect your attack surface from threats.
Ransomware accounts for 30% of cyber incidents with $270B+ in losses. Learn how exposed public-facing assets are the #1 entry point and how to reduce your attack surface.
# SEO Meta Description **Ransomware attacks surged 70% in 2023. Learn top attack vectors, prevention strategies, and how proactive threat intelligence can strengthen your ransomware defense.** *(158 characters)* This meta description works because it: - **Leads with a compelling statistic** (70% surge) to grab attention - **Includes key search terms**: ransomware attacks, attack vectors, prevention strategies, threat intelligence, ransomware defense - **Creates urgency** with the data point about the surge - **Promises actionable value** ("Learn...strategies") - **Stays under 160 characters** for full display in search results
The Censys research team has been closely monitoring the spread of ESXiArgs ransomware since it was first detected in early February. The team has used Censys internet scanning data to track infected hosts across countries, to monitor how the hacker group has since responded, and to develop a dashboard with Censys data that researchers […]
Mark Ellzey & Emily Austin Please see our new post, ESXiArgs: History, Variants, and SLP! for the latest updates. Executive Summary Over the last few days, Censys has observed just over 500 hosts newly infected with ESXiArgs ransomware, most of which are in France, Germany, the Netherlands, and the UK. During analysis, we discovered two […]
Emily Austin & Mark Ellzey UPDATE 2023-02-15 Please see our new post, The Evolution of ESXiArgs Ransomware, for further updates. UPDATE 2023-02-13 Over the weekend (2023-02-09 through 2023-02-11), we’ve seen a slight increase in the number of infected hosts, where at the time of writing, there were 1,994 hosts found in our search engine. We […]
Published on 09.10.2022 Introduction Deadbolt, a ransomware campaign haunting QNAP NAS customers for the last few months, has seen a consistent number of infections on a fairly regular cadence. But recently, Censys has observed a massive uptick in Deadbolt-infected QNAP devices. The Deadbolt crew is ramping up their operations, and the victim count is growing […]
Around June 24 2022, out of over 4.7 million hosts Censys observed in Russia, Censys discovered two Russian hosts containing an exploitation tool, Metasploit, and Command and Control (C2) tool, Deimos C2. Historical analysis indicated one of these Russian hosts also used the tool PoshC2. These tools allow penetration testers and hackers to gain access […]
On May 7, 2021, the FBI was “notified of a network disruption at Colonial Pipeline.” The public later learned, and the FBI confirmed, that this disruption was due to a ransomware attack perpetrated by the Russian-speaking DarkSide ransomware gang, based out of Eastern Europe. A look into the 2021 Colonial Pipeline ransomware attack This attack […]
Two months ago, in January of 2022, Censys reported on the spread of a new variant of ransomware dubbed Deadbolt. This ransomware targeted a series of network-attached storage devices (NAS) for consumers and small businesses running the QNAP QTS (Linux-based) operating system. What makes this particular variant unique is its communication with the victim. Instead […]
Authors: Mark Ellzey, Aidan Holland, Ryan Lindner Updates: Introduction On Jan. 25, 2022, several media outlets reported a ransomware attack targeting the Network Attached Storage (NAS) vendor QNAP. The news circulated soon after QNAP released a warning statement pleading with customers to “fight ransomware together” by disabling features on consumer routers and the QNAP devices […]
