New ransomware group uses printers to deliver ransom notes

Cybercriminals are now using office printers to deliver ransom notes to their victims, a tactic detailed by Kaspersky in recent ransomware cases in Colombia and Mexico. Attackers exploited misconfigured systems, locking victim drives with BitLocker and printing demands, with further coverage provided by Tech Radar.

The newly identified group, "XEntry Team," is reportedly behind these attacks. In Colombia, attackers gained access through an internet-exposed Remote Desktop Protocol (RDP) after disabling the Endpoint Protection Platform. In Mexico, the group exploited misconfigurations in the MSSQL service over three months, gradually lowering security settings. Notably, these attacks did not involve exploiting software vulnerabilities or social engineering, but rather leveraged system misconfigurations, which remain a significant risk.

Kaspersky highlighted that over 13% of incidents are related to policy violations and configuration errors, underscoring the need for strict adherence to cybersecurity best practices, particularly in RDP configurations.

Source: Tech Radar