Luke Connolly

Threat Analyst @ Emsisoft
Opinions are my own

[Luke Connolly @lnconnolly]

I've seen a lot of negative commentary about the news that Instructure "agreement with the unauthorized actor" this week. I wrote a short piece outlining the limited options the company had: https://t.co/fNATorofxJ

#Ransomware #Instructure #Canvas #ShinyHunters

[Luke Connolly @lnconnolly]

As cybersecurity defences improve, victim statistics grow unrelentingly. Adversarial nation-states maintain relationships with ransomware groups, maybe it's time for a radical change in our cybersecurity paradigm?My latest blog post considers this: https://t.co/bYyHWyyxhB

[Luke Connolly @lnconnolly]

2025 saw significant law enforcement wins targeting ransomware gangs, but the victim count continues to rise. I took a look at the numbers behind that.
https://t.co/4FAV0fTEKS

[Luke Connolly @lnconnolly]

Cybercriminal group Lynx has listed DeKalb County in GA as an alleged victim on their DLS. The incident was first discovered and reported in late September. Lynx first appeared in the summer of 2024, compiling over 300 alleged victims since then.
#ransomware @ItsInDeKalb

[Luke Connolly @lnconnolly]

Cybercriminal group Sinobi claims to have stolen 440GB of data from the Johnson Regional Medical Center in Clarksville AR, threatening to publish the data in 9 days. Sinobi first appeared in July of this year, and has claimed over 50 victims.
#ransomware
@JRMedicalCenter

[Luke Connolly @lnconnolly]

DeKalb County IA hit by cyber attack.
https://t.co/4zMEQyAyrz

[Luke Connolly @lnconnolly]

Cybercriminal group Qilin claims to have stolen data from Lakehaven Water and Sewer District in WA, announced a network disruption on Sept 3.

[Luke Connolly @lnconnolly]

Searching the dark web for new ransomware groups this weekend

[Luke Connolly @lnconnolly]

Cybercriminal group Rhysida is claiming the Maryland Department of Transportation as a victim, demanding 30 BTC, or almost $3.4 million in ransom.
#ransomware @MarylandDOT

[Luke Connolly @lnconnolly]

Criminal croup Qilin claims to be behind the Cybersecurity incident that hit Spartanburg County, SC in August. This is likely pressure tactic during ransom negotiations. Here's a reminder: Cybercriminals lie during and after negotiations.
#ransomware

[Luke Connolly @lnconnolly]

You have still have to carry a load when vacationing in Georgian Bay

[Luke Connolly @lnconnolly]

I went paddling in the beautiful Georgian Bay, Ontario twice this summer, and when I was back at work I had a lot of catching up to do. Some of what I read seemed to be using statistics as clickbait, which imo is an unfortunate waste of time. You decide https://t.co/Q318WyW9WS

[Luke Connolly @lnconnolly]

I logged into my Mac early Monday, and before I finished my first coffee I was presented with a Cloudflare human verification page. It was actually a ClickFix social engineering page, attempting to inject malware on my computer. Read what happened next: https://t.co/y9QwT0F8Dg

[Luke Connolly @lnconnolly]

Ransomware group Lynx is alleged to have breached the City of Batavia, NY
#ransomware

[Luke Connolly @lnconnolly]

Mecklenburg County Public Schools in VA has been dealing with a cybersecurity incident this week, the scope of which is undetermined.
https://t.co/NZq3Xbn6UW

[Luke Connolly @lnconnolly]

Criminal group Inc Ransom claims to have stolen 1.8 TB of data from the University of St. Thomas in Tx. Inc Ransom has been the 3rd most active ransomware group this summer, per https://t.co/sFMXzUaZQW and https://t.co/3sJAYgNBR8, with 105 victims claimed.
#ransomware

[Luke Connolly @lnconnolly]

It's a bad day for the cat car
https://t.co/KgStkjOign

[Luke Connolly @lnconnolly]

Chatham, Mass. is the latest victim to be posted on the DLS of criminal ransomware group Qilin. On their dark website, Qilin claims a staggering 80 victims this month alone.
#ransomware

[The Record From Recorded Future News @TheRecord_Media]

TransUnion told regulators that nearly 4.5 million people were impacted by a data breach involving a third-party application used for customer support https://t.co/edMTkPnE4K

[Luke Connolly @lnconnolly]

Cybercriminal group Kairos claims to have stolen 370 GB of data from Summit College, which operates 3 campuses in California. In the past, Kaisos has shown to focus on data exfiltration-based extortion rather than encryption.
#ransomware