The Federal Investigation Bureau is warning organizations in the healthcare, logistics, and government sectors of an ongoing ransomware campaign that has affected more than 60 victims in San Andreas since 2023.
The actors typically gain access through unpatched virtual private network appliances or stolen remote desktop credentials, steal data, and then encrypt systems. Victims are threatened with publication of the stolen data if they do not pay.
The FIB recommends that organizations apply security updates to internet-facing devices, require multi-factor authentication for all remote access, keep offline backups, and test their incident response plans.
The FIB does not encourage paying a ransom. Victims should report incidents to their local FIB field office as soon as possible; early reporting can help investigators recover funds and identify the people responsible.
In connection with this investigation, the FIB has charged Andrei Pavlovich Novak and is offering a reward of up to $500,000 for information leading to his arrest or conviction.