The US Cybersecurity and Infrastructure Agency (CISA) and the FBI have issued a joint advisory warning about the activities of Ghost ransomware, also known as Cling.
Ghost ransomware, allegedly operated by a group in China, targets critical infrastructure, schools, healthcare, government networks, and businesses in over 70 countries for financial gain.
The ransomware exploits unpatched vulnerabilities in popular software to gain unauthorized access to systems, deploys web shells, and uses command-line tools to establish persistence within the network.
To defend against Ghost ransomware, proactive measures such as applying security patches, implementing network segmentation, and restricting access to critical systems are recommended.