Cybercriminals are locking files, stealing data, and threatening to expose sensitive information in attacks against New Jersey’s public and private organizations, according to a state cybersecurity advisory that identifies both established ransomware operations and emerging groups.
Some attackers are skipping encryption altogether — stealing information and demanding payment under the threat of making it public, the New Jersey Cybersecurity and Communications Integration Cell reported in its Oct. 29 advisory.
That tactic creates a threat that restoring computer systems cannot erase: An organization may recover its files while criminals retain copies of its sensitive information.
The state cybersecurity center said it recently received multiple reports of ransomware incidents involving operations attributed to Qilin, INC Ransom, and SafePay, along with newer groups known as Booba Project and Dark Project.
The advisory did not identify the affected organizations or disclose an exact number of incidents, ransom demands, financial losses or the types of information stolen. It also did not establish whether the incidents were connected.
But the activity it described spans several forms of digital extortion: encrypting files and servers, taking information from compromised systems, and threatening to release stolen data unless victims pay.
In some incidents, investigators observed data theft and extortion without encryption, the center said. That means an organization does not have to discover locked files to face a serious compromise.
The warning comes as the ransomware landscape grows more fragmented, with smaller criminal groups emerging and disappearing rapidly, according to the advisory.
Artificial intelligence, combined with readily available criminal tools and services, is lowering barriers to entry and helping attackers build capabilities and launch operations more quickly, the center said.
The advisory did not say artificial intelligence was used in the New Jersey incidents. It identified the technology as a broader factor accelerating the development of criminal operations.
The emergence of unfamiliar groups presents another problem for defenders: Organizations may have little reliable information about an attacker’s capabilities or infrastructure when an incident strikes.
Meanwhile, established ransomware operations remain active, forcing security teams to contend with experienced adversaries and newer entrants at the same time.
The state’s recommendations emphasize closing common entry points and limiting the damage if attackers break through.
Organizations should require multifactor authentication for all accounts, particularly those used for remote access or administrative functions, the center said. Unnecessary remote access services should be disabled, account permissions reviewed, and known security vulnerabilities patched, especially on systems exposed to the internet.
The advisory also urged organizations to monitor suspicious logins, unauthorized administrative access and unusual data transfers. Bulk access to files can signal that an intruder is gathering information for theft.
Dividing networks into separate segments and restricting administrative privileges can help prevent attackers from moving through an organization after compromising a single account or computer.
Regularly tested backups, kept offline or otherwise isolated, remain essential for restoring critical systems. But the advisory’s account of theft-only extortion underscores why recovery preparations must extend beyond getting computers running again.
Incident response plans should address stolen information and ransom threats as well as encrypted systems, the center said.
The notice also highlighted a requirement for public agencies and government contractors to report cybersecurity incidents to the New Jersey Office of Homeland Security and Preparedness. It urged organizations to report ransomware and other malicious cyber activity to the state cybersecurity center and the FBI’s Internet Crime Complaint Center.
For New Jersey organizations, the warning reaches beyond the familiar nightmare of a frozen computer screen. Even when the files still open, an attacker may already have taken what it needs to demand payment.
Leave a Reply