Both the FBI and CISA (Cybersecurity and Infrastructure Security Agency) recently released a warning about a ransomware group called Ghost. This Chinese state-sponsored threat group means business, targeting everything from critical infrastructure and schools to healthcare and religious organizations. They also warn no organization of any kind is safe from Ghost attacks. Here’s what you need to know, now.

A Ransomware Group by Any Other Name

By changing tactics for hooking victims, Ghost is also known by a host of other names including Phantom, Cring, Strike, Rapture, Crypt3r and Hello. By whatever name, this threat group has successfully attacked organizations since 2021 and shows no end in sight.

Typically, Ghost ransomware enters an organization by exploiting CVEs (common vulnerabilities and exposures) to gain access to a system. Once inside, Ghost doesn’t stay long like other ransomware groups. These groups typically stay for weeks to months checking out different networks, planting various malware types, and deciding what information to ransom. Ghost is known to sweep into a system and deploy ransomware on the same day. 

Ghost ransom notes get sent via legitimate email services and threaten to sell a victim’s hijacked data if the ransom demand isn’t paid. The FBI says, “Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key…” Ghost actors, they warn, usually demand ransoms up to hundreds of thousands in cryptocurrency for decryption.

Keeping Ghost Away

Email phishing is one of Ghost’s tactics for entering a system. Since 91% of cybercrime gets delivered via phishing, pay special attention to its red flags. An unknown email sender or address, suspicious links and attachments and requiring sensitive PII like passwords for accounts are all email phishing red flags, as is some sense of urgency to take action.

Always keep system and other software updated with the latest security patches and bug fixes so known vulnerabilities aren’t exposed. The same goes for anti-virus software so it helps catch the latest malware threats. 

No organization wants to hear Ghost rattling its ransomware chains. So, stay alert and do all you can to prevent being the next victim.