Ransomware Roundup: 05.01.23

This report catalogs recent ransomware activity and trends: researchers identified a macOS-capable LockBit sample, Vice Society and Play are using custom PowerShell and VSS/Grixba tools to automate data exfiltration, Cl0p executed a large automated exploitation campaign against known GoAnywhere vulnerabilities, and attackers are using BYOVD tools like AuKill/Backstab to disable EDRs. The document emphasizes a shift to data-exfiltration-first operations, growing automation and scale, widespread exploitation of known vulnerabilities, and the resulting high financial and operational impact on victims.