Search — “BYOD”

Vanderbilt University confirmed it is responding to an active cybersecurity incident affecting devices, systems, and cloud services, and told users to shut down devices and disconnect from Wi-Fi. The BYOD ransomware gang claimed on its leak site to have encrypted databases and stolen over 1 million SSNs, and BleepingComputer received a photo of a ransom note on a Vanderbilt computer, but the university has not confirmed the group's involvement, encryption, or data theft. The sources publish no technical details of the intrusion, so no specific behaviors or indicators are available to hunt for.

The BYOD ransomware gang added Michigan State University to its leak site, claiming theft of personal information on 1.3 million current and former students. The university said it detected suspicious activity in early October, responded by requiring all NetID holders to reset passwords, and stated the activity appeared to be a potential credential compromise event with no evidence of a successful compromise of the central Active Directory environment or other data access. Hunters should review authentication logs for credential misuse around early October and monitor for BYOD-associated activity.

The University of New Mexico Health Sciences Center said its systems were restored and it did not pay a ransom after a cyberattack that forced ambulance diversions and class cancellations. A new ransomware group calling itself BYOD claimed the attack, offered free decryption keys, and demanded $2,500 to destroy stolen patient and employee data. The sources give no technical details on initial access, malware, or intrusion behaviors, so hunters have no concrete behaviors to pursue from this item.

The University of New Mexico Health System suffered a cyberattack on a Monday that forced IT to contain the issue, diverted ambulances for about two hours, and suspended outpatient surgeries and appointments. The organization notified federal law enforcement and did not confirm ransomware; the BYOD gang claimed the attack and asserted 36,000 machines and stolen data, which is unverified. No technical details on attack vector or behaviors were published, so hunters have no confirmed artifacts to search for beyond general ransomware indicators.