FBI and CISA Warn Against Ghost Ransomware in Latest Advisory

On February 19, 2025, the FBI and CISA released a joint advisory warning of active, global operations by the Ghost ransomware group—active since 2021 and responsible for recent attacks—detailing their use of known CVE exploits (e.g., FortiOS CVE-2018-13379, Adobe ColdFusion flaws), tools like Cobalt Strike, web shells, credential theft, lateral movement, data exfiltration, and deployment of ransomware (Cring.exe, Ghost.exe), along with provided IOCs and mitigation recommendations.