{"id":6417,"date":"2025-02-25T17:13:52","date_gmt":"2025-02-26T01:13:52","guid":{"rendered":"https:\/\/www.alvaka.net\/beta\/?p=6417"},"modified":"2026-09-15T17:16:26","modified_gmt":"2026-09-16T00:16:26","slug":"ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025","status":"publish","type":"post","link":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/","title":{"rendered":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025"},"content":{"rendered":"<p><span data-contrast=\"auto\">The cybersecurity landscape continues to face relentless attacks from organized ransomware groups. In February alone, four major threat actors\u2014<\/span><b><span data-contrast=\"auto\">Cactus, RansomHub, Play, and Medusa<\/span><\/b><span data-contrast=\"auto\">\u2014have been particularly active, targeting organizations across various industries.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">This data is collected from two of Alvaka\u2019s cybersecurity partners, <\/span><strong>Cyber Guards USA and Cybolt.<\/strong><span data-contrast=\"auto\"> These findings match what Alvaka has seen in the past two months in our <\/span><b><span data-contrast=\"auto\">ransomware recovery practice<\/span><\/b><span data-contrast=\"auto\">. Below is a breakdown of the tactics and techniques these groups are employing.<\/span><\/p>\n<h3><b><span data-contrast=\"none\">Cactus \u2013 Targeting VPN and Firewall Vulnerabilities<\/span><\/b><\/h3>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Victims<\/span><\/b><span data-contrast=\"auto\">: 14<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Primary Entry Point<\/span><\/b><span data-contrast=\"auto\">: Exploiting <\/span><b><span data-contrast=\"auto\">vulnerabilities in VPNs and firewalls<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Tactics &amp; Techniques<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span>\n<ul>\n<li><span data-contrast=\"auto\">Uses <\/span><b><span data-contrast=\"auto\">legitimate RMM (Remote Monitoring &amp; Management) software<\/span><\/b><span data-contrast=\"auto\"> (<\/span><i><span data-contrast=\"auto\">dwagent, ScreenConnect<\/span><\/i><span data-contrast=\"auto\">) to maintain persistence.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Conducts <\/span><b><span data-contrast=\"auto\">network reconnaissance<\/span><\/b><span data-contrast=\"auto\"> using <\/span><i><span data-contrast=\"auto\">netscan<\/span><\/i><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Deploys <\/span><b><span data-contrast=\"auto\">Command &amp; Control (C2) tools<\/span><\/b><span data-contrast=\"auto\">, primarily <\/span><i><span data-contrast=\"auto\">Chisel<\/span><\/i><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Relies on <\/span><b><span data-contrast=\"auto\">Living Off the Land (LOTL) techniques<\/span><\/b><span data-contrast=\"auto\">, including RDP and SSH.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Exfiltrates data using <\/span><b><span data-contrast=\"auto\">WinSCP<\/span><\/b><span data-contrast=\"auto\"> and <\/span><b><span data-contrast=\"auto\">rClone<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4><b><span data-contrast=\"auto\">Geographic Focus<\/span><\/b><span data-contrast=\"auto\">:<\/span><br \/>\n<span data-contrast=\"auto\">Cactus has been <\/span><b><span data-contrast=\"auto\">heavily targeting organizations on the U.S. West Coast and Canada<\/span><\/b><span data-contrast=\"auto\">. The attackers have also been observed <\/span><b><span data-contrast=\"auto\">emailing and calling employees<\/span><\/b><span data-contrast=\"auto\"> of victim organizations, indicating a social engineering component.<\/span><\/h4>\n<h3><b><span data-contrast=\"none\">RansomHub \u2013 A Ransomware-as-a-Service (RaaS) Operation<\/span><\/b><\/h3>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Victims<\/span><\/b><span data-contrast=\"auto\">: 37<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Tactics &amp; Techniques<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"2\"><span data-contrast=\"auto\">Uses a variety of <\/span><b><span data-contrast=\"auto\">legitimate RMM software<\/span><\/b><span data-contrast=\"auto\"> (<\/span><i><span data-contrast=\"auto\">AnyDesk, Atera, N-Able, ScreenConnect, Splashtop<\/span><\/i><span data-contrast=\"auto\">).<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"2\"><span data-contrast=\"auto\">Leverages <\/span><b><span data-contrast=\"auto\">Windows LOLBins<\/span><\/b><span data-contrast=\"auto\"> (<\/span><i><span data-contrast=\"auto\">BITSadmin, PSExec<\/span><\/i><span data-contrast=\"auto\">) to execute malicious payloads.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"2\"><span data-contrast=\"auto\">Exfiltrates data through <\/span><b><span data-contrast=\"auto\">WinSCP, rClone, and PSCP<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Threat Model<\/span><\/b><span data-contrast=\"auto\">:<\/span><br \/>\n<span data-contrast=\"auto\">RansomHub is likely operating under a <\/span><b><span data-contrast=\"auto\">Ransomware-as-a-Service (RaaS)<\/span><\/b><span data-contrast=\"auto\"> model, meaning multiple affiliates conduct attacks under a shared infrastructure.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Leak Site Activity<\/span><\/b><span data-contrast=\"auto\">:<\/span><br \/>\n<span data-contrast=\"auto\">This group has been <\/span><b><span data-contrast=\"auto\">actively updating their leak site daily<\/span><\/b><span data-contrast=\"auto\">, showcasing a consistent stream of new victims.<\/span><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3 aria-level=\"2\"><b><span data-contrast=\"none\">Play \u2013 Defense Evasion and Stealthy Exfiltration<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Victims<\/span><\/b><span data-contrast=\"auto\">: 30<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Tactics &amp; Techniques<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"2\"><span data-contrast=\"auto\">Uses <\/span><b><span data-contrast=\"auto\">defense evasion tools<\/span><\/b><span data-contrast=\"auto\"> such as <\/span><i><span data-contrast=\"auto\">IOBit<\/span><\/i><span data-contrast=\"auto\"> to avoid detection.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"2\"><span data-contrast=\"auto\">Deploys <\/span><b><span data-contrast=\"auto\">offensive security tools<\/span><\/b><span data-contrast=\"auto\"> like <\/span><i><span data-contrast=\"auto\">WinPEAS<\/span><\/i><span data-contrast=\"auto\"> and <\/span><i><span data-contrast=\"auto\">Cobalt Strike<\/span><\/i><span data-contrast=\"auto\"> to gain deep network access.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"2\"><span data-contrast=\"auto\">Relies on <\/span><b><span data-contrast=\"auto\">LOLBins like PSExec and WinSCP<\/span><\/b><span data-contrast=\"auto\"> for stealthy data exfiltration.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Play has shown a strong emphasis on <\/span><b><span data-contrast=\"auto\">remaining undetected for prolonged periods<\/span><\/b><span data-contrast=\"auto\">, making it one of the more difficult groups to mitigate.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"2\"><b><span data-contrast=\"none\">Medusa \u2013 Phishing, Network Reconnaissance, and Destruction<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Victims<\/span><\/b><span data-contrast=\"auto\">: 26<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Primary Entry Point<\/span><\/b><span data-contrast=\"auto\">: <\/span>Phishing attacks<\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Tactics &amp; Techniques<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"2\"><span data-contrast=\"auto\">Uses <\/span><b><span data-contrast=\"auto\">PowerShell and Command Prompt<\/span><\/b><span data-contrast=\"auto\"> to execute malicious commands.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"2\"><span data-contrast=\"auto\">Conducts <\/span><b><span data-contrast=\"auto\">network reconnaissance<\/span><\/b><span data-contrast=\"auto\"> with <\/span><i><span data-contrast=\"auto\">netscan<\/span><\/i><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"2\"><span data-contrast=\"auto\">Maintains persistence through <\/span><b><span data-contrast=\"auto\">ScreenConnect<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"2\"><span data-contrast=\"auto\">Uses <\/span><b><span data-contrast=\"auto\">BITSadmin and PSExec<\/span><\/b><span data-contrast=\"auto\"> for lateral movement.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"5\" data-aria-level=\"2\"><b><span data-contrast=\"auto\">Exfiltrates data over SSH on port 443<\/span><\/b><span data-contrast=\"auto\">, making detection more difficult.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"6\" data-aria-level=\"2\"><b><span data-contrast=\"auto\">Post-Exfiltration Actions<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"\uf0a7\" data-font=\"Wingdings\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:2160,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Wingdings&quot;,&quot;469769242&quot;:[9642],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0a7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"3\"><span data-contrast=\"auto\">Removes logs to erase evidence.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"\uf0a7\" data-font=\"Wingdings\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:2160,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Wingdings&quot;,&quot;469769242&quot;:[9642],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0a7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"3\"><span data-contrast=\"auto\">Destroys backups.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li data-leveltext=\"\uf0a7\" data-font=\"Wingdings\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:2160,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Wingdings&quot;,&quot;469769242&quot;:[9642],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0a7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"3\"><span data-contrast=\"auto\">Executes final-stage <\/span><b><span data-contrast=\"auto\">ransomware encryption<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><span class=\"TextRun SCXW189679483 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW189679483 BCX0\">Medusa\u2019s <\/span><\/span><span class=\"TextRun MacChromeBold SCXW189679483 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW189679483 BCX0\">structured attack chain<\/span><\/span><span class=\"TextRun SCXW189679483 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW189679483 BCX0\"> shows <\/span><span class=\"NormalTextRun SCXW189679483 BCX0\">a high level<\/span><span class=\"NormalTextRun SCXW189679483 BCX0\"> of sophistication, especially in covering its tracks before deploying ransomware.<\/span><\/span><span class=\"EOP SCXW189679483 BCX0\" data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"2\"><b><span data-contrast=\"none\">Key Takeaways &amp; Defensive Measures<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The patterns emerging from these attacks highlight <\/span><b><span data-contrast=\"auto\">three major security concerns<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ol>\n<li data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Exploitation of vulnerabilities in VPNs and firewalls<\/span><\/b><span data-contrast=\"auto\"> (Cactus).<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Increased abuse of legitimate RMM software for persistence<\/span><\/b><span data-contrast=\"auto\"> (RansomHub, Play, Medusa).<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Social engineering and phishing as primary attack vectors<\/span><\/b><span data-contrast=\"auto\"> (Medusa, Cactus).<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ol>\n<h4 aria-level=\"3\"><b><span data-contrast=\"none\">How to Defend Against These Threats:<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h4>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong><a href=\"https:\/\/www.patchworx.com\/\" target=\"_blank\" rel=\"noopener\">Patch and Update<\/a><\/strong><span data-contrast=\"auto\"> \u2013 Ensure VPNs, firewalls, and endpoint security software are regularly updated.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Monitor RMM Activity<\/span><\/b><span data-contrast=\"auto\"> \u2013 Identify unauthorized use of tools like AnyDesk, ScreenConnect, and Splashtop.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Implement Multi-Factor Authentication (MFA)<\/span><\/b><span data-contrast=\"auto\"> \u2013 Prevent unauthorized access even if credentials are stolen.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Conduct Phishing Awareness Training<\/span><\/b><span data-contrast=\"auto\"> \u2013 Educate employees to recognize and report suspicious emails.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Enable Network Segmentation<\/span><\/b><span data-contrast=\"auto\"> \u2013 Limit the ability of attackers to move laterally within an organization.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Review Data Exfiltration Tools<\/span><\/b><span data-contrast=\"auto\"> \u2013 Monitor for unauthorized use of WinSCP, rClone, and SSH-based transfers.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">These four ransomware groups are refining their techniques and expanding their operations. As cybercriminals become more advanced, <\/span><b><span data-contrast=\"auto\">organizations must take a proactive approach to security<\/span><\/b><span data-contrast=\"auto\"> by implementing strong defense mechanisms, monitoring network activity, and educating employees about emerging threats.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"3\"><b><span data-contrast=\"none\">Need Immediate Assistance?<\/span><\/b><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"auto\">If your organization is experiencing a ransomware incident or needs cybersecurity support, <\/span><strong><a href=\"https:\/\/choose.alvaka.net\/ransomware-recovery\/\" target=\"_blank\" rel=\"noopener\">Alvaka\u2019s ransomware recovery team<\/a><\/strong> <span data-contrast=\"auto\">is available to help.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<hr style=\"border: 0; border-top: 1px solid #CCCCCC; margin: 40px 0;\" \/>\n<p>Alvaka is available 24\u00d77 to assist you with any of your cybersecurity needs. Fill out the form on this page or call us at <a href=\"tel:9494285000\">(949)428-5000!<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The cybersecurity landscape continues to face relentless attacks from organized ransomware groups. In February alone, four major threat actors\u2014Cactus, RansomHub, Play, and Medusa\u2014have been particularly active, targeting organizations across various industries.\u00a0 This data is collected from two of Alvaka\u2019s cybersecurity partners, Cyber Guards USA and Cybolt. These findings match what Alvaka has seen in the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":714,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[19,24],"class_list":["post-6417","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles","tag-cybersecurity","tag-ransomware"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka<\/title>\n<meta name=\"description\" content=\"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka\" \/>\n<meta property=\"og:description\" content=\"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/\" \/>\n<meta property=\"og:site_name\" content=\"Alvaka Website\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-26T01:13:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-16T00:16:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"830\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alvaka Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alvaka Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/\"},\"author\":{\"name\":\"Alvaka Team\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#\\\/schema\\\/person\\\/4629df62c1f239cb0909896caaf55bb7\"},\"headline\":\"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025\",\"datePublished\":\"2025-02-26T01:13:52+00:00\",\"dateModified\":\"2026-09-16T00:16:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/\"},\"wordCount\":628,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Featured-Image.jpg\",\"keywords\":[\"Cybersecurity\",\"Ransomware\"],\"articleSection\":[\"Articles\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/\",\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/\",\"name\":\"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Featured-Image.jpg\",\"datePublished\":\"2025-02-26T01:13:52+00:00\",\"dateModified\":\"2026-09-16T00:16:26+00:00\",\"description\":\"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Featured-Image.jpg\",\"contentUrl\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Featured-Image.jpg\",\"width\":1600,\"height\":830},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#website\",\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/\",\"name\":\"Alvaka Website\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#organization\",\"name\":\"Alvaka Website\",\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Alvaka-logo-white-2.png\",\"contentUrl\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Alvaka-logo-white-2.png\",\"width\":209,\"height\":48,\"caption\":\"Alvaka Website\"},\"image\":{\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/#\\\/schema\\\/person\\\/4629df62c1f239cb0909896caaf55bb7\",\"name\":\"Alvaka Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g\",\"caption\":\"Alvaka Team\"},\"sameAs\":[\"https:\\\/\\\/alvaka.net\\\/beta\"],\"url\":\"https:\\\/\\\/www.alvaka.net\\\/beta\\\/author\\\/alvtlgclients-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka","description":"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka","og_description":"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.","og_url":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/","og_site_name":"Alvaka Website","article_published_time":"2025-02-26T01:13:52+00:00","article_modified_time":"2026-09-16T00:16:26+00:00","og_image":[{"width":1600,"height":830,"url":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg","type":"image\/jpeg"}],"author":"Alvaka Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Alvaka Team","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#article","isPartOf":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/"},"author":{"name":"Alvaka Team","@id":"https:\/\/www.alvaka.net\/beta\/#\/schema\/person\/4629df62c1f239cb0909896caaf55bb7"},"headline":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025","datePublished":"2025-02-26T01:13:52+00:00","dateModified":"2026-09-16T00:16:26+00:00","mainEntityOfPage":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/"},"wordCount":628,"commentCount":0,"publisher":{"@id":"https:\/\/www.alvaka.net\/beta\/#organization"},"image":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg","keywords":["Cybersecurity","Ransomware"],"articleSection":["Articles"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/","url":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/","name":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025 - Alvaka","isPartOf":{"@id":"https:\/\/www.alvaka.net\/beta\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#primaryimage"},"image":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg","datePublished":"2025-02-26T01:13:52+00:00","dateModified":"2026-09-16T00:16:26+00:00","description":"Ransomware attacks surge as four major cyber threat groups\u2014Cactus, RansomHub, Play, and Medusa\u2014wreak havoc in February.","breadcrumb":{"@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#primaryimage","url":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg","contentUrl":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Featured-Image.jpg","width":1600,"height":830},{"@type":"BreadcrumbList","@id":"https:\/\/www.alvaka.net\/beta\/ransomware-surge-4-cyber-threat-groups-wreaking-havoc-in-february-2025\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.alvaka.net\/beta\/"},{"@type":"ListItem","position":2,"name":"Ransomware Surge: 4 Cyber Threat Groups Wreaking Havoc in February 2025"}]},{"@type":"WebSite","@id":"https:\/\/www.alvaka.net\/beta\/#website","url":"https:\/\/www.alvaka.net\/beta\/","name":"Alvaka Website","description":"","publisher":{"@id":"https:\/\/www.alvaka.net\/beta\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.alvaka.net\/beta\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.alvaka.net\/beta\/#organization","name":"Alvaka Website","url":"https:\/\/www.alvaka.net\/beta\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.alvaka.net\/beta\/#\/schema\/logo\/image\/","url":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Alvaka-logo-white-2.png","contentUrl":"https:\/\/www.alvaka.net\/beta\/wp-content\/uploads\/2026\/06\/Alvaka-logo-white-2.png","width":209,"height":48,"caption":"Alvaka Website"},"image":{"@id":"https:\/\/www.alvaka.net\/beta\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.alvaka.net\/beta\/#\/schema\/person\/4629df62c1f239cb0909896caaf55bb7","name":"Alvaka Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ff0f7229721f07e2758536c92b69a58cb8fa511bd275a0e56d5a4b6c619a7a58?s=96&d=mm&r=g","caption":"Alvaka Team"},"sameAs":["https:\/\/alvaka.net\/beta"],"url":"https:\/\/www.alvaka.net\/beta\/author\/alvtlgclients-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/posts\/6417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/comments?post=6417"}],"version-history":[{"count":3,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/posts\/6417\/revisions"}],"predecessor-version":[{"id":6420,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/posts\/6417\/revisions\/6420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/media\/714"}],"wp:attachment":[{"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/media?parent=6417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/categories?post=6417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.alvaka.net\/beta\/wp-json\/wp\/v2\/tags?post=6417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}