Ransomware Roundup: 02.20.23

This report is a consolidated briefing on recent ransomware activity: DarkBit claimed a destructive ransomware attack on Israel’s Technion University with an 80 BTC ransom demand, a separate ransomware incident at Regal Medical Group potentially exposed PHI/PII of ~3.3M patients, and industry reports show an 87% year-over-year increase in ransomware against ICS with many operators exploiting older, well-known vulnerabilities. The briefing highlights ransomware operators’ use of double-extortion, RansomOps supply chains (IABs, affiliates, RaaS), and urges detection earlier in the attack lifecycle rather than relying solely on endpoint detection of payloads.