To help organizations protect against ransomware, CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a cybersecurity advisory warning organizations about the Phobos ransomware, and provided indicators of compromise and tactics, techniques, and procedures used by Phobos as recently as February.
According to the advisory, Phobos has been attacking “municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several million U.S. dollars.” Phobos threat actors gain access to networks through phishing campaigns, searching for vulnerable Remote Desktop Protocol (RDP) ports, including on Microsoft Windows environments, then use brute force tools to gain access and activate RDP authentication.
The advisory provides specific recommendations on mitigation to assist companies in reducing the risk of becoming a victim, which are worth checking out.