Ghost Ransomware: FBI and CISA Issue Joint Warning

The FBI and CISA have issued a joint advisory warning of the Ghost ransomware, active since 2021 and impacting critical infrastructure across various sectors in over 70 countries. The attackers exploit known vulnerabilities, using tools like Cobalt Strike to move laterally, steal data, and encrypt files for ransom. Effective defenses include patching vulnerabilities, regular backups, and monitoring for unauthorized activities, such as PowerShell usage. Victims with unaffected backups often restored operations without paying.