Recent Ghost/Cring ransomware activity prompts alert from FBI, CISA

The FBI and CISA alert warns that the Ghost/Cring ransomware group has been actively exploiting long-unpatched internet-facing vulnerabilities—including in Fortinet appliances, Adobe ColdFusion, and Exchange (ProxyShell)—to rapidly compromise organizations across more than 70 countries and sectors such as critical infrastructure, healthcare, education, government, and manufacturing; actors deploy common tools (Cobalt Strike, Mimikatz), use filenames like Cring.exe/Ghost.exe, demand large ransoms, and typically move quickly from initial access to encryption.