Ransomware and Recent Variants

guest · Mar 11, 2019

The Week in Ransomware - March 8th 2019 - OpJerusalem, Jokeroo, and More
March 8, 2019
https://www.bleepingcomputer.com/ne...-march-8th-2019-opjerusalem-jokeroo-and-more/

This week we had some interesting stories, with the two biggest being an alleged new Ransomware-as-a-Service called Jokeroo and the #OpJerusalem attack conducted against Israeli sites.

OpJerusalem's attack was an attempt to cause hundreds of Israeli web sites to distribute a fake Adobe Flash Player that installed the JCry ransomware. Due to a bug in the JavaScript being used, the ransomware executable was never distributed and instead visitors were greeted with a defaced web site message as shown below. [...]
Click to expand...

guest · Mar 11, 2019

STOP Ransomware Variant Installing Azorult Infostealer
March 11, 2019
https://www.tripwire.com/state-of-s...mware-variant-installing-azorult-infostealer/

A variant of the STOP ransomware family is downloading the Azorult infostealer onto victim’s machines as part of its infection process.

Bleeping Computer decided to verify Gillespie’s findings by downloading and installing a recent sample of STOP ransomware that appends “.promorad” to each affected file’s name. It wasn’t disappointed. Lawrence Abrams, creator and founder of Bleeping Computer, explains as much in a blog post:

The Promorad Ransomware variant samples we tested also download a file named 5.exe and executed it. When executed, the program will create network traffic that is identical to known command & control server communications for the Azorult information-stealing Trojan.
Users face the risk of password exposure should they suffer an infection at the hands of the STOP Promorad ransomware variant. As a result, they should make sure they stay on top of their software updates and exercise caution around suspicious email attachments.
Click to expand...

guest · Mar 11, 2019

Georgia County Criticized Over $400K Ransomware Payment
March 11, 2019
https://www.securityweek.com/georgia-county-criticized-over-400k-ransomware-payment

Jackson County, Georgia is just a little over 60 miles from the City of Atlanta. In March 2018, Atlanta was struck by a major ransomware attack. In March 2019, Jackson County suffered its own ransomware attack. Both attacks were successful targeted attacks -- but that's about all they have in common.

Atlanta chose not to pay the ransom -- even though the malware was quickly recognized as SamSam, and the SamSam actors had a reputation for delivering decryption keys on payment. Jackson County, reportedly, decided to pay the ransom.

This raises an interesting moral dilemma. Worldwide official advice is that ransoms should not be paid. The argument is that only if criminals cease to make money will they cease their attacks. But at what point is the moral obligation to protect taxpayer money more important than the moral requirement to fight criminals? There is no easy answer to this question.
Click to expand...

The implication, although it is only an implication, is that organizations that feel forced to pay the ransom probably have not invested sufficiently in their disaster recovery and backup capabilities.
Click to expand...

stapp · Mar 12, 2019

Yatron Ransomware Plans to Spread Using EternalBlue NSA Exploits.

A new Ransomware-as-a-Service called Yatron is being promoted on Twitter that plans on using the EternalBlue and DoublePulsar exploits to spread to other computer on a network. This ransomware will also attempt to delete encrypted files if a payment has not been made in 72 hours.
Click to expand...

https://www.bleepingcomputer.com/ne...ans-to-spread-using-eternalblue-nsa-exploits/

guest · Mar 13, 2019

GCSE coursework lost in cyber attack on Bridport school
March 13, 2019
https://www.bbc.com/news/uk-england-dorset-47551331

Hackers have used ransomware to encrypt files at a school, causing it to lose some students' GCSE coursework.

The Sir John Colfox Academy in Bridport, Dorset, said a member of staff mistakenly opened an email containing a virus.
The email claimed to be from a colleague at another Dorset school and infected the computer network.

Mr Herbert added a police expert "has advised us that it is very unlikely that any school information has left the building and we are not compromised in that way".
"Personal data relating to staff, students and parents is not held on this system and is secure," he said.
Click to expand...

guest · Mar 14, 2019

Cyberattacker demands ransom from Northern Colorado utility
March 14, 2019
https://eu.coloradoan.com/story/mon...r-demands-ransom-colorado-utility/3148951002/

The districts had fallen victim to a ransomware cyber attack, the second in two years, General Manager Chris Matkins said. Hackers were holding the data hostage and demanding a ransom payment before they'd unlock the information.
Matkins won't say how big the ransom demand was or how payment was to be made. "It's not something we will talk about," he said. "It didn't have any bearing on how we responded."
Ransomware a growing threat
It is still unclear how the ransomware made its way into the water districts' computers.

"We are seeing these types of attacks happen in more and more critical infrastructure scenarios ... it's in the interest of some of these companies to keep these out of the media," said Brendan Saltaformaggio, a professor at Georgia Tech's Institute for Information Security & Privacy.
Click to expand...

guest · Mar 15, 2019

Ballard NW Senior Center attacked by ransomware ahead of annual fundraiser
March 14, 2019
https://www.kiro7.com/news/local/ba...nsomware-ahead-of-annual-fundraiser/930703676

The Ballard Northwest Senior Center found itself in the bull's-eye of ransomware attack, with its server wiped just weeks before their biggest fundraiser of the year.

“We turned on our computers and nothing was there. Nothing. Everything was gone,” said Carlye Teel, executive director of the Ballard Northwest Senior Center.
The center quickly found out someone attacked them with ransomware, encrypting all their files, holding the data hostage.

“We don’t pay ransom,” she said. [...] It took more than a week of painstaking work, but luckily -- the center says its IT team managed to recover most the lost data. And now the rush is on.
Click to expand...

guest · Mar 15, 2019

ShutterstockBitcoin Ransomware Cripples Boston Legal System for Two Weeks
March 15, 2019
https://www.ccn.com/bitcoin-ransomware-cripples-boston-legal-system-for-two-weeks

Boston public defenders suffered a ransomware attack some weeks back but have chosen not to send the bitcoin demanded by the attacker. Instead, they decided to use back-ups to restore services. The Committee oversees public defenders in Boston.
PUBLIC DEFENDERS TAKE THE LONG WAY HOME
According to the Boston Globe, that decision has meant a “weekslong slowdown” that affects everyone in the system.
As a security measure, they’ve taken their systems offline in order to cleanse them of viruses.

The public defenders have not said how much of a ransom the attackers demanded. It varies based on the attacker and the ransomware software used. The cost to unlock a computer can be anywhere from $100 to many thousands of dollars
Click to expand...

guest · Mar 15, 2019

The Week in Ransomware - March 15th 2019 - STOP, Decryptors, and More
March 15, 2019
https://www.bleepingcomputer.com/ne...are-march-15th-2019-stop-decryptors-and-more/

This week we have seen a new decryptor released by both Emsisoft and Avast for the BigBobRoss ransomware. We also saw a lot of new variants released for existing ransomware, expecially the STOP Ransomware.

The STOP ransomware continues to be a major problem with its distribution through adware bundles disguised as cracks. To make matters worse, it was discovered that the STOP Ransomware is installing the Azorult information stealing Trojan as well on its victims. [...]
Click to expand...

guest · Mar 16, 2019

Analysis of Ransomware Epidemic In February 2019
March 15, 2019
https://blog.360totalsecurity.com/en/analysis-of-ransomware-epidemic-in-february-2019/

With the spread of Ransomware, Both company and individual have suffered serious threats. 360 Security Brain has comprehensively monitored and defended against the ransomware. The feedback on anti-ransomware services increased slightly, mainly due to the addition of several popular ransomwares in this month.

In the February 2019 ransomware feedback, the family share ratio statistics show that the GandCrab ransomware family is still the most popular ransom virus, closely to 50%. This is followed by a 26% of the GlobeImposter ransom family and 16% of the Crysis ransom family.
Click to expand...

guest · Mar 18, 2019

JNEC.a Ransomware Spread by WinRAR Ace Exploit
March 18, 2019
https://www.bleepingcomputer.com/news/security/jneca-ransomware-spread-by-winrar-ace-exploit/

A new ransomware called JNEC.a spreads through an exploit for the recently reported code execution ACE vulnerability in WinRAR. After encrypting a computer, it will generate a Gmail address that victims need to create in order to receive the file decryption key once they pay the ransom.

Once executed, the ransomware encrypts data on the computer and appends the .Jnec extension to the file’s original one. The price for the decryption key is 0.05 bitcoins (about $200).
The interesting part is that the malware author chose an unusual method to deliver the file decryption keys. The ID number unique for each affected computer represents a Gmail address for the delivery of the key.

To hide its presence, the author named it “GoogleUpdate.exe,” so it is easily mistaken for Google’s update process.
At the moment of writing, 29 antivirus engines detect JNEC.a as threat. The ransomware encrypts files in their entirety, which could be the reason we saw it move slowly during our tests.
Click to expand...

guest · Mar 19, 2019

Orange County hit and taken offline with ransomware
March 19, 2019
https://www.scmagazine.com/home/sec...county-hit-and-taken-offline-with-ransomware/

The Orange County, N.C., government was knocked offline by a ransomware attack early Monday morning.

County officials discovered files were being encrypted and shut down its entire network in an effort to stop the malware from spreading, effectively shutting down online access to most county services, according to a statement. An outside security firm has been retained to help restore services, but as of press time the county does not know how the malware was introduced nor did it mention a ransom amount.

Orange County joins a growing list of municipalities and companies that have been hit with ransomware attacks in the last few weeks.
Click to expand...

guest · Mar 20, 2019

Emsisoft Decrypter for PewCrypt
March 19, 2019
https://decrypter.emsisoft.com/pewcrypt

PewCrypt is a ransomware written in Java that uses AES and RSA to encrypt a victim's files, adding the extension ".PewCrypt". The malware then asks the victim to subscribe to PewDiePie.
The author supposedly released this as a "joke" in 2019 - but be assured, ransomware is no joke, ever.

To use the decrypter, you will require the "AES.key" file left on the desktop by the malware.
Click to expand...

ronjor · Mar 21, 2019

North Carolina County Suffers Repeat Ransomware Infections

Scott Ferguson March 21, 2019
A North Carolina county is recovering from the third ransomware attack that has hit its IT systems in the last six years. However, a spokesman says that no data has been lost or stolen.
Click to expand...

guest · Mar 21, 2019

UK’s Police Federation hit by ransomware
March 21, 2019
https://techcrunch.com/2019/03/21/police-federation-ransomware/

The U.K.’s Police Federation has confirmed it’s been hit by a cyberattack.

The union-like organization, representing 119,000 police officers across the 43 forces in England and Wales, described the event as ransomware in a statement shared on Twitter.
The ransomware attack hit computers at the federation’s Surrey headquarters on March 9, but was only revealed Thursday. Several databases and email systems were encrypted, the organization said, leading to some disruption to its services. Its backup data had also been deleted.

“There is no evidence at this stage that any data was extracted from our systems but this cannot be discounted,” the organization said in a tweet.
None of the other 43 branches across the U.K. were affected, the statement said.
Click to expand...

guest · Mar 21, 2019

PewDiePie fans keep making junk ransomware
March 21, 2019
https://www.zdnet.com/article/pewdiepie-fans-keep-making-junk-ransomware/

For some misguided reason, PewDiePie fans seem to believe that making and releasing ransomware is a proper and acceptable method of supporting their idol.
While so-called "joke ransomware" has been released in the past, these two PewDiePie-themed ransomware strains are either destroying user data or encrypting files without any reasonable expectation or method to recover the data.
THE TWO RANSOMWARE STRAINS
The first of these strains was released in mid-December last year. Called the "PewDiePie ransomware," this was a poor attempt at modifying the ShellLocker ransomware.
A second one appeared in January, and this was actually a fully functional ransomware strain. Called PewCrypt, this ransomware was coded in Java, and it encrypted users' files in the "proper" way, with a method of recovering files at a later date.

While the ransomware was put together as a joke, sadly, it did infect a few users, ZDNet has learned.
Its author eventually realized the world of trouble he'd get into if any of those victims filed complaints with authorities, and released the ransomware's source code on GitHub, along with a command-line-based decryption tool.
Click to expand...

guest · Mar 22, 2019

The Week in Ransomware - March 22nd 2019 - LOCKERGOGA!
March 22, 2019
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-22nd-2019-lockergoga/

This week has been dominated by the news of aluminum producer Norsk Hydro being crippled by the LockerGoga Ransomware. Since then, it has been constant news coverage regarding the ransomware and more in-depth analysis.

It should be noted that while this ransomware has had high profile targets, it is not the most active one out there targeting companies and has not seen wide distribution. Furthermore, it's very noisy as it consumes a lot of CPU, causes explorer to crash repeatedly, and borks the system enough while encrypting that you can't run normal programs. Unless its launched on an idle machine, it would have a good chance of being spotted.

Other than that, it is has been mostly new variants of old ransomware released this week and a new ransomware called JNEC.a that was distributed via the WinRAR ACE vulnerability. [...]
Click to expand...

guest · Mar 23, 2019

Taos schools resolving ransomware attack
March 21, 2019
https://taosnews.com/stories/taos-schools-resolving-ransomware-attack,55866

Taos Municipal Schools District has been hard at work addressing a ransomware attack that knocked out the district's digital services almost three weeks ago.

On Feb. 28, Taos Schools suffered a cyber attack, with hackers demanding $5,000 in cash as ransom for the return of the control to their digital services. Emails, class instruction and the district website were disabled as part of the attack, which has been mostly resolved according to school officials Thursday (March 21).

“Our IT department has been working 20 hour days to recreate our websites,” said Taos Superintendent Lilian Torrez, who said there's no evidence personal information of students or staff was compromised.
No money was paid and staff have eliminated the threat, she said.
Click to expand...

guest · Mar 23, 2019

Ransomware Forces Two Chemical Companies to Order ‘Hundreds of New Computers’
March 23, 2019
https://motherboard.vice.com/en_us/article/8xyj7g/ransomware-forces-two-chemical-companies-to-order-hundreds-of-new-computers/

A ransomware attack appears to have affected two American chemicals companies, Motherboard has learned.

Hexion and Momentive, which make resins, silicones, and other materials, and are controlled by the same investment fund, were hit by the ransomware on March 12, according to a current employee. An internal email obtained by Motherboard and signed by Momentive’s CEO Jack Boss refers to a “global IT outage” that required the companies to deploy “SWAT teams” to manage.

Based on the ransom message, the ransomware that hit Hexion and Momentive appears to be LockerGoga, the same ransomware that forced an aluminum manufacturing giant Norsk Hydro [...]"
Boss’s email said that the data on any computers that were hit with the ransomware is probably lost, and that the company has ordered "hundreds of new computers.”

On Friday evening, Hexion announced in a press release that it was working to resume normal operations “in response to a recent network security incident.”
Click to expand...

itman · Mar 23, 2019

mood said: ↑

Ransomware Forces Two Chemical Companies to Order ‘Hundreds of New Computers’
Click to expand...

I guess there weren't using Eset. It had a sig. for this dating to 2/1/2019. Also of note was the only Next Gen that detected at VT on 3/19 was Cylance. There were also some big name AVs not detecting it and of course, WD didn't also.

guest · Mar 25, 2019

Emsisoft has Released a Decryptor for the Hacked Ransomware
March 25, 2019
https://www.bleepingcomputer.com/ra...leased-a-decryptor-for-the-hacked-ransomware/

A decryptor for the Hacked Ransomware was released today by Emsisoft that allows victims to recover their files for free. This ransomware was active in 2017 and targeted English, Turkish, Spanish, and Italian users.

At the time it was discovered, though, a weakness could not be discovered in the ransomware's encryption scheme and users had to pay for decryption, recover from backups, or simply live without their files. Fast forward a year and half later and Michael Gillespie has discovered a weakness that allowed him to create a decryptor so that victims can recover their files for free.

You should then run the program with administrative privileges in order to decrypt all the files that were targeted by the ransomware. Once started, the decryptor will search the computer for encrypted files that end with the .hacked extension and automatically decrypt them.
Click to expand...

Emsisoft Decrypter for HKCrypt

guest · Mar 25, 2019

Halting the Lockergoga Ransomware
March 25, 2019
https://blog.alertlogic.com/halting-the-lockergoga-ransomware/

Most of the time attackers exploit coding errors in applications to get access to systems and data but every so often we get a chance to exploit their lack of testing and resulting coding errors to affect their malicious code. In this case a simple error in a piece of malware gives us an opportunity.
The Missing .lnk
Once the ransomware becomes resident on the victim host, it performs an initial reconnaissance scan to gather file lists before it executes its encryption routine.

When it encounters a ‘.lnk’ file it will utilize the built-in shell32 / linkinfo DLLs to resolve the ‘.lnk’ path. However, if this ‘.lnk’ path has one of a series of errors in it, then it will raise an exception—an exception which the malware does not handle.
Click to expand...

We have identified two conditions for the ‘.lnk’ file which would allow it to halt the ransomware in its tracks:

The ‘.lnk’ file has been crafted to contain an invalid network path

The ‘.lnk’ file has no associated RPC endpoint

Note that in our testing these ‘.lnk’ files had to be resident in the ‘Recent Items’ folder.
Click to expand...

guest · Mar 28, 2019

UNNAM3D Ransomware Locks Files in Protected Archives, Demands Gift Cards
March 28, 2019
https://www.bleepingcomputer.com/ne...les-in-protected-archives-demands-gift-cards/

A new ransomware called Unnam3d R@nsomware is being distributed via email that will move a victim's files into password protected RAR archives. The ransomware then demands a $50 Amazon gift card code in order to get the archive password.

When executed, the ransomware will extract a bundled WinRar.exe executable to the %Temp% folder and execute [...] During this process, the ransomware will move the files under the Documents, Pictures, and Desktop folder into their own individual RAR archives.
Ransomware developer say they sent 30K emails
In a conversation with BleepingComputer, the ransomware developer, who goes by the alias Unnam3d, stated that they started their email campaign three days ago and have sent it to approximately 30 thousand people.
This email campaign pretends to be an email from Adobe stating that the recipient's Adobe Flash Player is outdated and needs to be updated. These emails then contain a link to a fake Adobe Flash Player Update that installs the ransomware.
Click to expand...

guest · Mar 28, 2019

Parking garage hit with Ransomware
Our parking garage was hacked leading to free parking but huge headaches
March 27, 2019
https://cira.ca/blog/cybersecurity/hack-close-home-parking-garage-hit-ransomware

However, a closer look revealed the true source of the problem, not a power failure, mechanical issue or system crash—the automated parking system had been hit with ransomware.

To clarify, the parking garage is run by a separate company, CIRA has not been impacted, but it just goes to show how commonplace these hacks have become. Dozens of employee credit cards are possibly in that database which will undoubtedly reclaim all the time we will save over the coming days in not having to scan our parking passes.

We have no way of knowing what cybersecurity measures parking company has in place, but as we saw in our CIRA Cybersecurity Survey, 37 per cent of businesses don’t have anti-malware protection installed and 71 per cent did not have a formal patching policy. Hackers are starting to exploit those gaps at companies of all sizes and industries.
Click to expand...

...Dharma Ransomware:

https://www.bleepingcomputer.com/ne...ge-of-canadian-domain-registration-authority/
The ransom note displayed on the screens of infected systems points to Dharma ransomware.

Dharma ransomware is typically installed manually on systems that have Remote Desktop Services exposed on the internet. Attackers scan the web looking for computers running RDP and try to brute-force their way in.

If the method was used in the case of Precise ParkLink, it is possible that this was not a targeted attack and hackers simply infected the vulnerable computers discovered in the scanning process.
For the time being, there is no free decryption tool for Dharma ransomware.
Click to expand...

guest · Mar 29, 2019

The Week in Ransomware - March 29th 2019 - Parking for Free!
March 29, 2019
https://www.bleepingcomputer.com/ne...-ransomware-march-29th-2019-parking-for-free/

This week we saw numerous new variants of existing ransomware released, with only a few new families. The one new ransomware infection that was actively distributed this week is called UNNAM3D and was distributed through spam emails to about 30 thousand people.

In other news, a parking garage in Canada got hit with the Darhma ransomware that caused them to shutdown their payment system. This let everyone who parked there to do so for free during the outage. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

stapp Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches