Phishing Campaign Deploys Ransomware Dormant for a Year

The Israel National Cyber Directorate (INCD) has issued an advisory regarding a sophisticated phishing campaign culminating in a ransomware attack. Notably, the ransomware remained dormant on user systems for approximately one year before activation, highlighting a significant delay tactic employed by threat actors.

This extended dormancy period allowed the malware to evade initial detection and persist within environments, posing a long-term threat. The INCD’s findings underscore the importance of continuous monitoring and advanced threat detection capabilities that can identify dormant or low-activity malicious payloads.

Organizations are urged to review their security logs and incident response procedures to detect any signs of similar prolonged compromise. Proactive threat hunting for unusual file persistence or network activity, even if seemingly benign, is critical in mitigating such stealthy attacks.

Attached Files:

• תוכן ההתרעה
• csv קובץ המזהים