ransomware Archives | Security Sense

University of Illinois Chicago College of Medicine Ransomware Incident

Posted on October 5, 2026 by Kyle

Overview

A ransomware attack has impacted the University of Illinois Chicago (UIC) College of Medicine, leading to the unauthorized access and theft of information from its servers. This incident highlights the critical risk ransomware presents to organizations holding sensitive data, particularly within the education and healthcare sectors, where data exfiltration often precedes encryption.

Technical Analysis

The provided source confirms a ransomware attack affected the UIC College of Medicine, resulting in data theft. Specific details regarding the initial access vector, the ransomware variant deployed, or the technical execution chain are not publicly available at the time of writing. Ransomware operations typically involve initial compromise (e.g., phishing, exploiting vulnerabilities), lateral movement, privilege escalation, data exfiltration, and finally, encryption of systems.

Detection

Given the lack of specific indicators for this incident, detection efforts should focus on general ransomware behaviors:
* Shadow Copy Deletion: Monitoring for vssadmin.exe or wmic.exe commands used to delete shadow copies, often a precursor to encryption.
* Mass File Renames/Encryption: Detecting a high volume of file rename operations or the creation of files with known ransomware extensions (e.g., .locked, .enc, .crypt).
* Suspicious Process Activity: Identifying unusual process trees, such as cmd.exe or powershell.exe being spawned by non-standard parent processes (e.g., a web server, database service) to execute system commands.
* Network Traffic Anomalies: Monitoring for large outbound data transfers indicative of data exfiltration to unknown or suspicious IP addresses.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Suspicious Shadow Copy Deletion via Vssadmin

title: Suspicious Shadow Copy Deletion via Vssadmin
id: 93f7e1b2-c8d3-4a1e-b0a6-f2d1e2a8c3d7
status: experimental
description: Detects attempts to delete shadow copies using vssadmin.exe, a common ransomware tactic.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
level: high

Suspicious Shadow Copy Deletion via WMIC

title: Suspicious Shadow Copy Deletion via WMIC
id: 7e1b2c8d-3a4e-b0a6-f2d1e2a8c3d8
status: experimental
description: Detects attempts to delete shadow copies using wmic.exe, another common ransomware tactic.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: selection
level: high

Unusual Process Spawning System Commands

title: Unusual Process Spawning System Commands
id: 1b2c8d3a-4eb0-a6f2-d1e2a8c3d9e0
status: experimental
description: Identifies suspicious process creations where non-standard parent processes spawn cmd.exe or powershell.exe to execute system commands, potentially indicative of compromise or ransomware activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|contains:
      - '\\inetpub\\wwwroot\\'
      - '\\Program Files\\Microsoft SQL Server\\'
      - '\\Apache24\\bin\\httpd.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: selection
level: medium

Mitigations

Maintain Regular Backups: Implement a robust backup strategy following the 3-2-1 rule, ensuring backups are immutable and stored offline or off-site.
Patch and Update Systems: Regularly apply security patches and updates to operating systems, applications, and network devices to remediate known vulnerabilities.
Implement Network Segmentation: Segment networks to limit lateral movement and contain potential breaches, isolating critical systems and sensitive data.
Deploy Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious activities, detect ransomware behaviors, and enable rapid response.
Enforce Principle of Least Privilege: Restrict user and service accounts to the minimum necessary permissions required for their functions.
Conduct Security Awareness Training: Educate users on identifying and reporting phishing attempts and other social engineering tactics.

References

https://therecord.media/ransomware-university-illinois-chicago

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1486 — Data Encrypted for Impact
T1070.004 — File Deletion
T1560.001 — Archive via Utility
T1059.003 — Windows Command Shell
T1059.001 — PowerShell

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,463 input / 1,362 output tokens ·

  Reviewed and approved by a human analyst before publication

Keio Corporation Confirms Ransomware Attack Disrupting Business Systems

Posted on September 28, 2026 by Kyle

Overview

Keio Corporation, a major private railway operator in Japan, has confirmed a ransomware attack that impacted some of its internal business systems over the weekend. While public transportation services remained operational, the incident caused disruption to administrative and operational support functions, prompting an ongoing investigation into its scope and impact.

Technical Analysis

Specific details regarding the ransomware family, initial access vector, and the exact systems compromised have not been publicly disclosed by Keio Corporation at the time of writing. Generally, ransomware attacks involve unauthorized access to a network, lateral movement, privilege escalation, and ultimately, the deployment of malware to encrypt critical files and systems. Common attack vectors include exploiting unpatched vulnerabilities, phishing campaigns, or compromised credentials, often followed by attempts to disable security software and delete backup copies to hinder recovery efforts.

Detection

Monitor for vssadmin.exe execution with delete shadows or similar commands, indicating attempts to remove shadow copies.
Detect wbadmin.exe execution with delete backup or delete catalog commands, targeting system backups.
Look for suspicious PowerShell commands aimed at disabling security features (e.g., Windows Defender) or deleting system recovery points.
Identify rapid, high-volume file encryption activity, often characterized by unusual file renames or the creation of new files with specific ransomware extensions (though no specific extensions are known for this incident).
Monitor for unusual process creation from system utilities (e.g., cmd.exe, powershell.exe) originating from non-standard parent processes or executing atypical commands.

Sigma Detection Rules

Ransomware – VSSAdmin Shadow Copy Deletion

title: Ransomware - VSSAdmin Shadow Copy Deletion
id: 9a2e3f1b-5c7d-4e0a-8b1c-2d4f6e7a8b9c
status: experimental
description: Detects attempts by ransomware to delete shadow copies using vssadmin.exe, a common tactic to prevent system recovery.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete ShadowCopies'
  condition: selection
level: critical

Ransomware – WBAdmin Backup Deletion

title: Ransomware - WBAdmin Backup Deletion
id: 7c1b5d9e-3a2f-4c8d-6e0a-1b3f5d7e9a0c
status: experimental
description: Detects attempts to delete system backups using wbadmin.exe, a common ransomware tactic.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete backup'
      - 'delete catalog'
  condition: selection
level: critical

Ransomware – PowerShell System Recovery Disablement

title: Ransomware - PowerShell System Recovery Disablement
id: 5f8a1c3e-7b9d-4e2a-0c6b-8d1f3e5a7b9c
status: experimental
description: Detects PowerShell commands commonly used by ransomware to disable system recovery features or security mechanisms. Requires PowerShell Script Block Logging.
logsource:
  product: windows
  service: powershell
  definition: 'Script Block Logging must be enabled'
detection:
  selection:
    ScriptBlockText|contains:
      - 'Disable-WindowsDefender'
      - 'Set-MpPreference -DisableRealtimeMonitoring $true'
      - 'Set-MpPreference -DisableBehaviorMonitoring $true'
      - 'Set-MpPreference -DisableIOAVProtection $true'
      - 'Set-MpPreference -DisableArchiveScanning $true'
      - 'Set-MpPreference -MAPSReporting Disabled'
      - 'Set-MpPreference -SubmitSamplesConsent NeverSend'
      - 'Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule" -Name "TaskCache"'
      - 'Get-WmiObject -Class Win32_Shadowcopy | ForEach-Object {$_.Delete()}'
  condition: selection
level: high

Mitigations

Implement robust patch management for all operating systems, applications, and network devices, prioritizing internet-facing assets and critical infrastructure components.
Enforce multi-factor authentication (MFA) for all remote access, administrative accounts, and critical business applications to prevent unauthorized access.
Regularly back up critical data, ensuring backups are immutable, isolated from the production network, and regularly tested for restorability.
Implement network segmentation to limit lateral movement within the network and contain potential breaches to specific segments.
Conduct regular security awareness training for all employees, focusing on identifying and reporting phishing attempts and social engineering tactics.
Deploy and maintain endpoint detection and response (EDR) solutions to monitor for suspicious activity, block malicious processes, and provide rapid incident response capabilities.

References

https://www.bleepingcomputer.com/news/security/japans-keio-confirms-ransomware-attack-disrupted-business-systems/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1486 — Data Encrypted for Impact
T1490 — Inhibit System Recovery
T1070.004 — File Deletion

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,493 input / 1,460 output tokens ·

  Reviewed and approved by a human analyst before publication

Storm-2570 Ransomware Affiliate Tradecraft Analysis

Posted on September 28, 2026 by Kyle

Overview

Storm-2570 is a ransomware affiliate group that consistently employs similar post-compromise tools and techniques across various ransomware deployments. This group has been observed deploying Qilin, DragonForce, Anubis, and BERT ransomware families. Understanding their consistent tradecraft is crucial for defenders to detect and disrupt their activities before the final ransomware payload is executed.

Technical Analysis

Storm-2570 operates as a ransomware affiliate, indicating they likely gain initial access and establish persistence before deploying one of several ransomware families. Their operations are characterized by consistent post-compromise tradecraft, suggesting a standardized playbook for internal network reconnaissance, privilege escalation, lateral movement, and data exfiltration, culminating in ransomware deployment.
* Ransomware Families Observed: Qilin, DragonForce, Anubis, BERT.
* Attack Vector: Not specified in the provided source, but typically involves initial access methods like phishing, exploiting public-facing applications, or compromised credentials.
* Prerequisites: Successful initial compromise and establishment of a foothold within the target environment.

Detection

Detection efforts should focus on the consistent post-compromise activities that precede ransomware deployment. While specific tools are not detailed in the provided source, common ransomware affiliate behaviors include:
* Suspicious process creation by services or system accounts (e.g., cmd.exe, powershell.exe).
* Execution of legitimate administrative tools for malicious purposes (e.g., PsExec, net.exe, wmic.exe).
* Deletion of shadow copies using vssadmin.exe.
* Attempts to disable security software.
* Abnormal network connections for data exfiltration or command and control.

Sigma Detection Rules

Ransomware – Shadow Copy Deletion via Vssadmin

title: Ransomware - Shadow Copy Deletion via Vssadmin
id: 9a0b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects attempts to delete shadow copies using vssadmin.exe, a common precursor to ransomware encryption.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
level: high

Suspicious Process Creation by Services

title: Suspicious Process Creation by Services
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects common command-line interpreters or administrative tools spawned by services, which can indicate post-compromise activity by ransomware affiliates.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith:
      - '\\services.exe'
      - '\\svchost.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\wmic.exe'
      - '\\mshta.exe'
      - '\\regsvr32.exe'
  condition: selection
level: medium

Mitigations

Implement strong access controls and least privilege: Limit user and service account permissions to only what is necessary.
Patch and update systems regularly: Prioritize patching internet-facing applications and systems.
Deploy endpoint detection and response (EDR) solutions: Monitor for suspicious process activity, file modifications, and network connections.
Regularly back up critical data: Ensure backups are isolated and immutable to prevent ransomware encryption.
Educate users on phishing and social engineering: Reduce the risk of initial access via user compromise.

References

Microsoft Security Blog: Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1059 — Command and Scripting Interpreter
T1082 — System Information Discovery
T1018 — Remote System Discovery
T1021 — Remote Services
T1490 — Inhibit System Recovery
T1486 — Data Encrypted for Impact

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,609 input / 1,235 output tokens ·

  Reviewed and approved by a human analyst before publication