Ransomware and Recent Variants

Minimalist · Feb 4, 2019

Ransomware Victims Who Pay Cough Up $6,733 (on Average)

Ransomware victims who opt to pay their attackes for the promise of a decryption key forked over, on average, $6,733 during the fourth quarter of 2018, up 13 percent from the previous quarter, says ransomware incident response firm Coveware.
Click to expand...

https://www.databreachtoday.com/ransomware-victims-who-pay-cough-up-6733-on-average-a-11994

guest · Feb 4, 2019

Tracking Anatova: Malwarebytes discovers new version of DASH-hungry ransomware
Modular malware now demanding more than $1,200 for decryption
February 4, 2019
https://portswigger.net/daily-swig/...scovers-new-version-of-dash-hungry-ransomware

With less than 350 confirmed global infections, Anatova has a long was to go before it reaches GandCrab-level notoriety. And when it comes to the ransomware’s modular functionality, security researchers can only speculate about the developer’s future intentions due to a lack of hard evidence.

Despite this mystery, it appears that this malware is still in active development, as Malwarebytes researchers last week informed The Daily Swig that they have been tracking a new version – a variant which demands double the original ransom fee.

“We have been tracking development Anatova ransomware since it appeared on the scene earlier this year, and we have already [discovered] a second version of this modular ransomware… which now asks for 20 DASH instead of 10 DASH as it did [with] the first version reported by McAfee,” said Marcelo Rivero, malware intelligence analyst at Malwarebytes.
Click to expand...

Minimalist · Feb 8, 2019

MongoDB databases still being held for ransom, two years after attacks started

Two years after hacker groups began ransacking MongoDB databases and requesting ransom payments, the practice is still very much alive, ZDNet has learned this week.
Click to expand...

https://www.zdnet.com/article/mongo...d-for-ransom-two-years-after-attacks-started/

ronjor · Feb 8, 2019

Ransomware Attack Via MSP Locks Customers Out of Systems

Jai Vijayan 2/7/2019
Vulnerable plugin for a remote management tool gave attackers a way to encrypt systems belonging to all customers of a US-based MSP.
In this case, the executable was Gandcrab, a widely distributed ransomware tool that has been used in numerous previous attacks. All customer systems that the MSP was managing via the Kaseya RMM tool were encrypted simultaneously, locking users out of them.
Click to expand...

guest · Feb 8, 2019

The Week in Ransomware - February 8th 2019 - Shady Data Recovery Companies
February 8, 2019
https://www.bleepingcomputer.com/ne...ruary-8th-2019-shady-data-recovery-companies/

This week was mostly filled with new variants of existing ransomware such as STOP, Dharma, and Jigsaw ransomware. We did though have some interesting news, such as a ransomware downloader being created from the pixels of images and shady data recovery companies partnering with GandCrab to make extra profits. [...]
Click to expand...

Minimalist · Feb 9, 2019

Minimalist said: ↑

Del Rio City Hall Forced to Use Paper After Ransomware Attack
Click to expand...

What happens when a city is knocked offline by hackers

City officials in the sleepy West Texas border town of Del Rio arrived to work on Jan. 10 to an ominous situation — their computers didn't work.

At first, the internet appeared not to be functioning, but the city's IT department soon confirmed that their entire system had been encrypted and hackers were asking for a ransom to unlock it.
Click to expand...

https://news.vice.com/en_us/article/a3be8a/what-happens-when-a-city-is-knocked-offline-by-hackers

itman · Feb 15, 2019

Ransomware Attacks Target MSPs to Mass-Infect Customers

Makes sense this would be the next logical progression in ransomware delivery:

Ransomware distributors have started to target managed service providers (MSPs) in order to mass-infect all of their clients in a single attack. Recent reports indicate that multiple MSPs have been hacked recently, which has led to hundreds, if not thousands, of clients being infected with the GandCrab Ransomware.

With the mass distribution of ransomware increasingly becoming more difficult through methods such a spam, attackers are coming up with more creative ways to infect their victims. This includes hacking into RDP, teaming up with criminal download monetization companies, renting the services of botnet operators, and now attacking MSPs.

According to security consulting firm HuntressLabs, the attackers are gaining access to MSPs through a vulnerability in use to link two software products that are commonly used by MSPs to manage the endpoints of their clients and perform remote administration.
Click to expand...

https://www.bleepingcomputer.com/ne...attacks-target-msps-to-mass-infect-customers/

guest · Feb 16, 2019

Ransomware attacks would become felony with Maryland bill
February 15, 2019
https://eu.delmarvanow.com/story/ne...would-become-felony-maryland-bill/2869037002/

Using ransomware to hold computers hostage would draw stiffer penalties under legislation — prompted in part by attacks on Maryland hospitals over the past few years — state lawmakers are considering.

The legislation, which would enforce tougher penalties for those convicted of ransomware crimes, was spurred by attacks like those on the University of Maryland Medical System in 2018 and on the Salisbury Police Department in January.
Maryland Senate bill 151, cross-filed with House bill 211, would define ransomware attacks that result in a loss greater than $1,000 as a felony, subject to a fine of up to $100,000 and a maximum sentence of 10 years in prison.

Under current Maryland laws, a ransomware attack that extorts a loss less than $10,000 is considered a misdemeanor, while a breach that results in a loss greater than $10,000 is a felony.
Click to expand...

guest · Feb 16, 2019

The Week in Ransomware - February 15th 2019 - Attack on MSPs
February 16, 2019
https://www.bleepingcomputer.com/ne...ransomware-february-15th-2019-attack-on-msps/

It has been a really dead week with ransomware, which we are always happy to see. Not much new variants released, other than the standard ones such as Matrix and Dharma.

The biggest news this week has been GandCrab affiliates targeting vulnerabilities in MSP software that allows them to infect all the clients they manage. This is an effective way to infect many different machines at once by compromising a single server. [...]
Click to expand...

guest · Feb 19, 2019

The Muncy malware is on the rise
February 19, 2019
https://securityaffairs.co/wordpress/81373/malware/muncy-malware-phishing.html

Muncy is the name dubbed by SI-LAB that analyzed this threat. Now, the malware is targeting user’s worldwide and has been spread via phishing campaigns.

Malicious actors are using SMTP servers leveraging bad server’s configuration. Email spoofing technique is used to impersonate the giant DHL; a popular distribution firm; sending a shipment notification to the user’s email inbox.
The malware is packed, and after the initial execution, a new process is created and executed (the unpacked malware). That process executes a mass scan in user’s C:\ drive obtaining sensitive information that is sent to a domain managed by crooks and available at sameerd[.]net.

Muncy malware shows how malicious actors may quickly vary attack techniques and artifact characteristics. Due to that, detect its intent is very difficult and that makes much harder the malware analyst work!
As shown, static code analysis and even the use of a debugger became inefficient, and when a debugger is running, the malware simply triggered an error evading its analysis.
Click to expand...

guest · Feb 20, 2019

Ryuk ransomware "still going strong"
Multiple groups still using Ryuk to extort money from companies
February 20, 2019
https://www.itproportal.com/news/ryuk-ransomware-still-going-strong/

It’s almost March 2019, but the Ryuk ransomware is still going strong.
Latest reports from McAfee and Coveware claim that there are still “several” hacking groups using Ryuk to extort money out of their victims.

The groups behind the attack ‘have a relation with one of the post-Soviet republics’, it was said, mostly because Russian text was found in one of the encrypted files. Also, there were some cultural references being thrown around during ransom negotiations.

The ransomware itself seems to descend from Hermes2.1. It’s not designed to target large corporations but still, the attackers demand 10 times more money than your average cybercrime organisations.
Usually, they start with a $145,000 demand, but some companies get a 60 per cent discount, if they can be granted negotiation privileges.
Click to expand...

guest · Feb 21, 2019

Researchers paint different portraits of hackers behind Ryuk ransomware
February 20, 2019
https://www.cyberscoop.com/researchers-paint-different-portraits-hackers-behind-ryuk-ransomware/

Analysts poring over the Ryuk ransomware are coming to different conclusions about the hackers responsible and the victims they’re targeting, highlighting the subjective side of cyberthreat studies.

Newly published research from McAfee and Coveware finds that the average ransom payment involving Ryuk is more than 10 times that of other types of ransomware.
The research follows a January report from another company, CrowdStrike, saying that hackers had earned $3.7 million from Ryuk since the ransomware emerged in August.

But the two analyses, which dissect Ryuk’s code, differ on the scope of those responsible, as well as the victims the ransomware was meant to target.
Divergent opinions from researchers over the makeup of hacking groups is common. Despite the enhanced visibility that powerful companies bring to network activity, the picture of who is behind the deployment of malware can be murky.
Click to expand...

guest · Feb 22, 2019

Cr1ptT0r Ransomware Targets Embedded Systems, Infects D-Link NAS Gear
February 22, 2019
https://www.bleepingcomputer.com/ne...ets-embedded-systems-infects-d-link-nas-gear/

A new ransomware called Cr1ptT0r built for embedded systems targets network attached storage (NAS) equipment exposed to the internet to encrypt data available on it.

Cr1ptT0r was first discovered in the BleepingComputer forums where users stated that their D-Link DNS-320 devices were infected by the ransomware. D-Link no longer sells the DNS-320 enclosure but the product page indicates that it is still supported.
Old firmware is a sitting duck
Details are scarce at the moment, but BleepingComputer forum members offer information suggesting that the attack vector is most likely vulnerabilities in old firmware.
Some users affected by Cr1ptT0r admitted to having an outdated firmware version installed and that their device was exposed to the internet at the time of the attack.

Cr1ptT0r is new on the market, but it looks like it's planning a long stay. It is built for Linux systems, with a focus on embedded devices, but it can be adapted to Windows, too, according to its maker.
Click to expand...

guest · Feb 23, 2019

Payroll Provider Gives Extortionists a Payday
February 23, 2019
https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company’s customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the process of restoring service to customers.

Ian Oxman, the company’s chief marketing officer, said the ransomware never touched customer data, but instead encrypted and disrupted everything in the company’s computer systems and at its off-site disaster recovery systems.

Oxman said Apex hired two outside security firms, and by Feb. 20 the consensus among all three was that paying the ransom was the fastest way to get back online. The company declined to specify how much was paid or what strain of ransomware was responsible for the attack.
Click to expand...

“When they encrypt the data, that happens really fast,” he said. “When they gave us the keys to decrypt it, things didn’t go quite as cleanly.”

Experts say attacks like the one against Apex HCM are playing out across the world every day, and have turned into a billion-dollar business for cyber thieves.
Click to expand...

guest · Feb 24, 2019

B0r0nt0K Ransomware Wants $75,000 Ransom, Infects Linux Servers
February 24, 2019
https://www.bleepingcomputer.com/ne...re-wants-75-000-ransom-infects-linux-servers/

A new ransomware called B0r0nt0K is encrypting victim's web sites and demanding a 20 bitcoin, or approximately $75,000, ransom. This ransomware is known to infect Linux servers, but may also be able to encrypt users running Windows.

In a BleepingComputer forum post, a user stated that a client's web site was encrypted with the new B0r0nt0K Ransomware. This encrypted web site was running on Ubuntu 16.04 and had all of its files encrypted, renamed, and had the .rontok extension appended to them.
When examining the source code for the payment site, BleepingComputer noticed the "Vietnamese Hacker" embedded comment. While this could indicate that the developer is Vietnamese, this is by no means proof.
Click to expand...

guest · Feb 26, 2019

Madras University comes under Ransomware attack
February 26, 2019
https://www.deccanchronicle.com/nat...university-comes-under-ransomware-attack.html

The database of the University of Madras faced a serious threat in the form of Ransomware (a malicious software) attack on Monday following which the data was encrypted and the attacker demanded a ransom of Rs 18 lakh to restore access to the data.
But, the university escaped the attack as it had stored the back-up data on the non-network system.

The university has two servers - the front end server which is application server and data server. Normally, the data server is not exposed to the outside world and thereby limiting the chances of hacking it.
He also said that the encrypted data does not include any critical data related to students, staff members and financial matters. “The data related to routine affairs only encrypted,” he said adding not a single data was lost in the ransomware attack.

“There is one firewall available for the entire institution. Now we are going for a group-wise firewall. Based on the recommendation, we will go for level 2 and level 3 security measures,” the professor Sivaji added.
Click to expand...

guest · Feb 27, 2019

Most Canadians 'likely to encounter' cybercrime, expert says after attack on youth services organization
Marymound, which cares for vulnerable Manitoba kids, says 3rd-party server kept data safe in ransomware attack
February 27, 2019
https://www.cbc.ca/news/canada/manitoba/ransomware-marymound-attack-1.5034950

Ransomware — malicious software that infects a computer and restricts access to a system until a ransom is paid — had infected the system of an organization that cares for some of Manitoba's most vulnerable youth.

Within 90 minutes of the attack at Marymound, the social services organization's third-party IT service provider had been informed of the breach and was working to restore operations.
The cyberattack left workers at Marymound — which provides services for thousands of kids each year through its school, foster homes and community programs — unable to use their computers for days.

Parker said because Marymound's information was backed up to an off-site server, it was secure and could be restored without paying the ransom.
Click to expand...

The provincial government, which funds a large portion of Marymound's budget, was informed of the incident, she said.

A spokesperson for the provincial government declined to discuss its protocol for ransomware or whether the government has been attacked, saying it does not comment on security matters.
"If government systems are affected by ransomware, we assess issues on a case-by-case basis," the spokesperson said in a prepared statement.
Click to expand...

DBeck · Feb 28, 2019

Does Olympia know the method of attack? Did they have backup procedures in place to support recovery efforts? How are they sure customer personal information was not compromised?

guest · Mar 1, 2019

The Week in Ransomware - March 1st 2019 - Cr1ptT0r, B0r0nt0K, and More
March 1, 2019
https://www.bleepingcomputer.com/ne...re-march-1st-2019-cr1ptt0r-b0r0nt0k-and-more/

Over the past two weeks, there has been some interesting ransomware news regarding a new GandCrab decryptor and two new ransomware infections.

First, BitDefender released a decryptor for GandCrab versions 5.1 and lower. This will allow victims of these versions to get their files back for free.
We then had the B0r0nt0K Ransomware, which appears to target Linux servers using PHP, but could also target Windows machines who have PHP installed. The second ransomware is Cr1ptT0r, which is targeting D-Link routers that are no longer supported. [...]
Click to expand...

Minimalist · Mar 2, 2019

Ransomware Pretends to Be Proton Security Team Securing Data From Hackers

A recent variant of the GarrantyDecrypt ransomware has been found that pretends to be from the security team for Proton Technologies, the company behind ProtonMail and ProtonVPN.
Click to expand...

https://www.bleepingcomputer.com/ne...ton-security-team-securing-data-from-hackers/

guest · Mar 5, 2019

CryptoMix Clop Ransomware Says It's Targeting Networks, Not Computers
March 5, 2019
https://www.bleepingcomputer.com/ne...re-says-its-targeting-networks-not-computers/

A new CryptoMix Ransomware variant has been discovered that appends the .CLOP or .CIOP extension to encrypted files. Of particular interest, is that this variant is now indicating that the attackers are targeting entire networks rather than individual computers.
This variant is currently being distributed using executables that have been code-signed with a digital signature. Doing so makes the executable appear more legitimate and may help to bypass security software detections.

In an analysis by security researcher Vitali Kremez, when started this variant will first stop numerous Windows services and processes in order to disable antivirus software and close all files so that they are ready for encryption. Examples of processes that are shutdown include Microsoft Exchange, Microsoft SQL Server, MySQL, BackupExec, and more.
Click to expand...

guest · Mar 6, 2019

Jokeroo Ransomware-as-a-Service Offers Multiple Membership Packages
March 5, 2019
https://www.bleepingcomputer.com/ne...-service-offers-multiple-membership-packages/

A new Ransomware-as-a-Service called Jokeroo is being promoted on underground hacking sites and via Twitter that allows affiliates to allegedly gain access to a fully functional ransomware and payment server.

Unlike most ransomware-as-a-service offerings, in order to become an affiliate a would-be criminal has to pay to join a particular membership package.
These packages range from $90 USD, where the affiliate earns 85% of the ransom payments, to $300 and $600 packages where the affiliates keep all of the revenue and gets extra perks such as Salsa20 encryption, different ransomware variants, and different payment cryptocurrency options.

Once again, while the RaaS page has been created, there is no indication that this ransomware is currently being distributed. As we get more information, we will update this article.
Click to expand...

guest · Mar 7, 2019

Rural Jackson County, Ga., recovering from ransomware attack
March 6, 2019
https://statescoop.com/rural-jackson-county-ga-recovering-from-ransomware-attack/

Computer systems in rural Jackson County, Georgia, were knocked offline over the weekend after being hit with a ransomware virus. The entire county government’s email system is offline, and some departments, including law enforcement, have had to resort to conducting their operations entirely on paper.

The type of ransomware and the payment demanded were not disclosed.
Mangum told StateScoop the cyberattack, which county officials first disclosed to the public on Tuesday, was discovered over the weekend. County officials also posted a message on Facebook Wednesday morning telling residents the county’s email services had been disabled.
Click to expand...

guest · Mar 8, 2019

mood said: ↑

Rural Jackson County, Ga., recovering from ransomware attack
March 6, 2019
https://statescoop.com/rural-jackson-county-ga-recovering-from-ransomware-attack/
Click to expand...

Cyber attack forces Jackson County to pay $400K ransom
March 8, 2019
https://www.onlineathens.com/news/20190308/cyber-attack-forces-jackson-county-to-pay-400k-ransom

The Jackson County government paid online criminals about $400,000 this week following a cyber attack that crippled the county’s computer system.

“In dealing with the FBI and cyber security experts, this is one of the most sophisticated attacks they have ever seen in the U.S.,” Poe said.
“They’ve been in our system I guess a couple of weeks,” Poe said. “They really plotted their attacks before they hit us. They totally crippled us.”

Poe described the virus that attacked the county’s system as Ryuk Ransomware, which is “fairly new and a lot of anti-viruses are not used to it.”
Click to expand...

stapp · Mar 10, 2019

Emsisoft releases a free decrypter for BigBobRoss Ransomware

https://support.emsisoft.com/topic/...bross-ransomware/?tab=comments#comment-191149

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

DBeck Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

DBeck Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

stapp Global Moderator

Useful Searches