{"id":48991,"date":"2022-10-24T10:36:33","date_gmt":"2022-10-24T10:36:33","guid":{"rendered":"http:\/\/badc3c82-64ad-44e0-a885-9e8200747d3a"},"modified":"2022-10-24T10:36:33","modified_gmt":"2022-10-24T10:36:33","slug":"fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/","title":{"rendered":"FBI warning: This ransomware group is targeting poorly protected VPN servers"},"content":{"rendered":"<figure class=\"c-shortcodeImage u-clearfix c-shortcodeImage-large\">\n<div class=\"c-shortcodeImage_imageContainer\">\n<div class=\"c-shortcodeImage_image\"><picture class=\"c-cmsImage c-cmsImage_loaded\"><source media=\"(max-width: 767px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/bbe4825ac3b40f932d831fa2802f73dec9feca52\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=768\" alt=\"fbi-hacker-left-align.jpg\"><source media=\"(max-width: 1023px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/7de213121e097ce4952107f40959ee1ba9ad62d2\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1024\" alt=\"fbi-hacker-left-align.jpg\"><source media=\"(max-width: 1440px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\" alt=\"fbi-hacker-left-align.jpg\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\" alt=\"fbi-hacker-left-align.jpg\" width=\"1200\" height=\"761.977186311787\" fetchpriority=\"low\"><\/picture><\/div>\n<p> <!----><\/div>\n<p> <!----> <!----><\/figure>\n<p>The FBI and other agencies are warning of a rise in Daixin Team ransomware and data extortion attacks on healthcare providers. &nbsp;<\/p>\n<p>The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) has&nbsp;<a href=\"https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/aa22-294a\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">issued a joint warning about Daixin Team<\/a> activity against the healthcare and public health sector since June 2022. &nbsp;<\/p>\n<p>The group has used ransomware to encrypt servers providing services for electronic health records, diagnostics, imaging, and intranet. They have also exfiltrated personal identifiable information and patient health information.&nbsp;<\/p>\n<p>The agencies are warning health providers to secure VPN servers as this was how the group gained access to previous targets, including exploiting an unpatched flaw in the victim&#8217;s VPN server. In another confirmed case, the actors used previously compromised credentials to access a legacy VPN server where multi-factor authentication (MFA) was not enabled. The actors are believed to have acquired the VPN credentials through a phishing email with a malicious attachment.&nbsp;<\/p>\n<p><strong>Also: <\/strong><a href=\"https:\/\/www.zdnet.com\/article\/ransomware-why-its-still-a-big-threat-and-where-the-gangs-are-going-next\/\" rel=\"follow\"><strong>Ransomware: Why it&#8217;s still a big threat, and where the gangs are going next<\/strong><\/a><\/p>\n<p>After accessing the VPN, the group used remote protocols SSH and RDP to move laterally, then sought privileged accounts through credential dumping and &#8216;pass the hash&#8217;, where attackers use stolen password hashes to move laterally. &nbsp; &nbsp; &nbsp;<\/p>\n<p>The actors have also used privileged accounts to access VMware vCenter Server and reset account passwords for ESXi servers in the environment. Then they use SSH to connect to accessible ESXi servers and deploy ransomware on those servers, according to the advisory.&nbsp;<\/p>\n<p>The Daixin group also exfiltrated data from victim systems.<\/p>\n<p>Among several mitigations, the advisory says organizations must prioritize patching VPN servers, remote-access software, virtual-machine software, and CISA&#8217;s known-exploited vulnerabilities. It also recommends locking down RDP and turning off SSH, as well as Telnet, Winbox, and HTTP for wide-area networks, and securing them with strong passwords and encryption when enabled. Organizations should also require MFA for as many services as possible.&nbsp;<\/p>\n<p>Because lives can depend on these systems, providers in the sector are routinely targeted by cyber criminals. The FBI&#8217;s Internet Crime Complaint Center (IC3) data indicates the health sector accounts for 25% of ransomware complaints of victim reports across all 16 critical infrastructure sectors.&nbsp;<\/p>\n<p>Also, in IC3&#8217;s 2021 annual report, the HPH Sector accounted for 148 ransomware reports. It was the largest source of ransomware complaints within the 649 ransomware reports made that year across 14 critical infrastructure sectors.<\/p>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers are using VPN servers to gain access, and then SSH and RDP to spread through networks.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-48991","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-24T10:36:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"FBI warning: This ransomware group is targeting poorly protected VPN servers\",\"datePublished\":\"2022-10-24T10:36:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/\"},\"wordCount\":425,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/573ea3c37d0852e52da29c7cafc21add185df86a\\\/2022\\\/06\\\/08\\\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\\\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/\",\"name\":\"FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/573ea3c37d0852e52da29c7cafc21add185df86a\\\/2022\\\/06\\\/08\\\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\\\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\",\"datePublished\":\"2022-10-24T10:36:33+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/573ea3c37d0852e52da29c7cafc21add185df86a\\\/2022\\\/06\\\/08\\\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\\\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/573ea3c37d0852e52da29c7cafc21add185df86a\\\/2022\\\/06\\\/08\\\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\\\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"FBI warning: This ransomware group is targeting poorly protected VPN servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/","og_locale":"en_US","og_type":"article","og_title":"FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-10-24T10:36:33+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"FBI warning: This ransomware group is targeting poorly protected VPN servers","datePublished":"2022-10-24T10:36:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/"},"wordCount":425,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/","url":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/","name":"FBI warning: This ransomware group is targeting poorly protected VPN servers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200","datePublished":"2022-10-24T10:36:33+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/573ea3c37d0852e52da29c7cafc21add185df86a\/2022\/06\/08\/f8544edd-4c72-4ef6-9f2b-a936bb0131ac\/fbi-hacker-left-align.jpg?auto=webp&amp;width=1200"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/fbi-warning-this-ransomware-group-is-targeting-poorly-protected-vpn-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"FBI warning: This ransomware group is targeting poorly protected VPN servers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=48991"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48991\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=48991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=48991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=48991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}