Ransomware and Recent Variants

guest · Apr 19, 2019

Mitsubishi Aerospace is one of the latest victims of Ryuk ransomware... shhhh!
April 13, 2019
https://www.peerlyst.com/posts/mits...ims-of-ryuk-ransomware-shhhh-kimberly-crawley

Mitsubishi Aerospace in Mississauga (near Toronto, Canada) is one of the latest victims of Ryuk ransomware. This might be the first or only news article you’ll read about the attack, because the only publicly available source as of this writing is this video from CityNews: [...]
That particular Mitsubishi Aerospace plant makes wings and fuselage for Bombardier aircraft. The very limited media coverage of this cyber attack may have something to do with how secretive Mitsubishi has been about it so far.

Mitsubishi hasn’t directly acknowledged the attack, and has released a statement [...] Canadian Minister of Defence Harjit Sajjan was similarly evasive [...] So the CityNews report suspects Russian or North Korean cyberwarfare.
You gotta love how the media in Canada and the United States likes to blame everything on Russia.
Click to expand...

guest · Apr 19, 2019

PayPal receives patent for ransomware detection technology
April 19, 2019
https://www.zdnet.com/article/paypal-receives-patent-for-ransomware-detection-technology/

The United States Patent and Trademark Office has granted this week a patent to online payments company PayPal for a technique for detecting and stopping ransomware attacks.
HOW PAYPAL CAN DETECT RANSOMWARE
At the patent's heart is the technique through which PayPal claims it can detect the onset of a ransomware infection.

PayPal says that its system will watch for when local files are loaded inside a computer's memory cache system, the place all files are loaded when an application needs to execute an operation.
PayPal's system will look for a certain action pattern --when the file is duplicated, and high-entropy (encryption) operations are performed on the duplicate.

If the app process executing these operations is not on the whitelist, PayPal's system will stop the process, and/or send a copy of the original file to a remote cloud service for backup storage.
Click to expand...

guest · Apr 19, 2019

What did Ransomware do in March?
April 19, 2019
https://blog.360totalsecurity.com/en/what-did-ransomware-do-in-march/

The top three target infection systems are Windows. 7, Windows Server 2008 and Windows 10. The feedback volume of anti-ransomware services has also dropped slightly, but the new Paradise ransomware has a large feedback, which requires special attention.

An analysis of the proportion of the ransomware family this month found that the GandCrab ransomware family still accounted for the highest proportion of all ransomware families – up to 38.06%, but decreased by 8.5% compared with February, GlobeImposter ransomware family followed by 25.10% and 16.13% of the Crysis ransom family.
[...]
The ransomware attack against the server is still a major direction of the current ransomware. Enterprises need to strengthen their information security management capabilities—especially weak passwords, vulnerabilities, file sharing, and remote desktop management to deal with the threat of ransomware.
Click to expand...

guest · Apr 19, 2019

New INPIVX Service May Change the Ransomware Game
April 19, 2019
https://www.bleepingcomputer.com/news/security/new-inpivx-service-may-change-the-ransomware-game/

A new service called Inpivx pushes the ransomware business to a new stage of evolution, making it easy to set up shop for those that lack the technical skills to develop the malware from scratch and build a management panel.

Promoted on a Tor site, the Inpivx team makes a straightforward offer for its customers that differs from the ransomware-as-a-service (RaaS) approach that has gained popularity lately.
For a specific price, they provide source code for the file-encrypting (symmetrical, AES encryption + RSA public-key cryptography) malware and for the management dashboard for a specific price. This model allows cybercriminals to make their own customizations to the code, or use it as a baseline for a new ransomware strain.

Inpivx approach is highly likely to attract to the ransomware game individuals with expertise in other areas of the crime business. With access to the source code, they can alter the original ransomware product and create new strains that could evolve to something new by combining code from other malware.
Click to expand...

guest · Apr 23, 2019

Ryuk virus culprit in Stuart ransomware attack
Stuart's city hall ransomware attack "more than likely" caused by phishing email scam
April 22, 2019
https://eu.tcpalm.com/story/news/lo...y-linked-phishing-email-scam-ryuk/3540067002/

The city is still recovering from an April 13 ransomware virus attack that most likely came from a phishing email scam on an employee’s desktop computer, the city manager said Monday.

A computer virus dubbed Ryuk attacked the city’s servers in a ransomware demand that City Manager David Dyess said forced the city to disconnect from its network.
Email is still not available, he told city commissioners Monday night, but other servers have been restored. It could be a week to ten days before the city's entire system is rebuilt, he said.

The virus attack, he said, was likely not a “brute-force” attack on a server that hackers would install remotely.
Dyess wouldn’t say how much ransom was demanded and the city refused to negotiate. It’s unclear who launched the cyberattack.
Click to expand...

guest · Apr 24, 2019

Manufacturing giant Aebi Schmidt hit by ransomware
April 23, 2019
https://techcrunch.com/2019/04/23/aebi-schmidt-ransomware/

Aebi Schmidt, a European manufacturing giant with operations in the U.S., has been hit by a ransomware attack, TechCrunch has learned.
The Switzerland-based maker of airport maintenance and road cleaning vehicles had operations disrupted Tuesday following the malware infection, according to a source with knowledge of the incident.

A number of systems connected to the Aebi Schmidt network across the world were left paralyzed. The source said systems necessary for manufacturing operations were inaccessible following the attack. The company’s email is also said to be affected.
It isn’t immediately known what kind of ransomware knocked the company’s systems offline.

“I can confirm that the availability of other systems was or may still be limited, our specialists are still working on resolving the issue, the cause is not yet clear,” he said, but would not comment further.
Click to expand...

guest · Apr 26, 2019

Ransomware disables Cleveland airport’s email systems, information screens
April 25, 2019
https://www.scmagazine.com/home/sec...d-airports-email-systems-information-screens/

A ransomware attack reportedly has affected email, payroll and record-keeping systems at Cleveland Hopkins International Airport this week and also darkened the transportation facility’s information screens
And according to a report from local news outlet WKYC, the attackers may have also accessed airport employee payroll records containing personal information.

“All other systems are functioning as normal and there are no impacts to flights or safety and security operations,” the release continued.
The attack began on Monday the 22nd and continued to impact airport display screens as of at least Wednesday, April 24. The FBI is reportedly investigating.
Click to expand...

guest · Apr 26, 2019

mood said: ↑

City working to ID source of ransomware attack
April 11, 2019
http://www.reflector.com/News/2019/04/11/City-working-to-ID-source-of-ransomware-attack.html
Click to expand...

Greenville in recovery phase from Robbinhood ransomware attack
April 26, 2019
https://www.scmagazine.com/home/sec...very-phase-from-robbinhood-ransomware-attack/

The city of Greenville, N.C., said it is recovering from the April 10 ransomware attack that had effectively knocked the city offline, without having to resort to paying the ransom demand.
City officials told WCTI12 the government network had been locked up by the relatively new Robbinhood ransomware, also known has Hidden Tear.

Greenville’s systems are not fully back online and city officials do not have a completion date for the process.
Click to expand...

guest · Apr 26, 2019

A Closer Look at the RobbinHood Ransomware
April 26, 2019
https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/

Since it first came out, samples of the RobbinHood ransomware have not been easy to come by. Yesterday, though, MalwareHunterTeam was able to find a sample so that it could be reverse engineered and tested to learn more about it.
Taking a look at RobbinHood
As we previously stated, it has not been confirmed how the ransomware gains access to a network and the computer's on it.
Security researcher Vitali Kremez, who reverse engineered the sample, told BleepingComputer that on execution it will stop 181 Windows services associated with antivirus, database, mail server, and other software that could keep files open and prevent their encryption. It does this by issuing the "sc.exe stop" command as shown below.
A full list of services stopped by RobbinHood are found at the end of the article.

In addition to stopping Windows services, RobbinHood also disconnects all network shares from the computer [...] Kremez told us that this could indicate that the payload is being pushed to each individual machine via a domain controller or through a framework like Empire PowerShell and PSExec
Click to expand...

guest · Apr 26, 2019

The Week in Ransomware - April 26th 2019 - Targeting the Enterprise
April 26, 2019
https://www.bleepingcomputer.com/ne...are-april-26th-2019-targeting-the-enterprise/

This week the biggest news is that MalwareHunterTeam was able to get a sample of the RobbinHood ransomware that targets the enterprise so that it could be analyzed. The other big news is that attackers are hacking into Confluence servers using a recently released vulnerability to install the GandCrab ransomware, miners, and Trojans.

Other than that, it has mostly been new variants of existing ransomware such as STOP Djvu, Dharma, Paradise, and others. [...]
Click to expand...

guest · Apr 26, 2019

Ransomware takes down servers at local school district
April 26, 2019
https://www.eastidahonews.com/2019/04/ransomware-takes-down-servers-at-local-school-district/

A ransomware attack locked up all of Sugar-Salem School District 322’s servers this week — right during ISAT testing.

District 322 became aware of a ransomware attack affecting their servers Tuesday and immediately shut them and all the computers down. Superintendent Chester Bradshaw said no sensitive data, such as student information, was lost but ISAT testing had to be stopped
“We caught it really quickly. We got it shut down before any sensitive information was leaked out. We’re thankful about that,” Bradshaw told EastIdahoNews.com.

“(The Ransomware attack) shut us down for two days. We’re right in the middle of ISAT testing. Without internet, we can’t ISAT test.” Bradshaw said.
Click to expand...

guest · Apr 27, 2019

mood said: ↑

Ransomware disables Cleveland airport’s email systems, information screens
April 25, 2019
https://www.scmagazine.com/home/sec...d-airports-email-systems-information-screens/
Click to expand...

Cleveland says airport info screen woes weren’t from hacking
April 26, 2019
https://www.thestate.com/news/business/technology/article229737184.html

In a statement Friday about the problems at Cleveland Hopkins International Airport, the city said that the computer systems weren't accessed by unauthorized personnel and that no ransom demands were involved. It reiterated that the problem causing the information screens to go blank didn't affect the airport's security and operations systems.

The problem began Monday. The FBI indicated earlier this week that it was conducting a "collaborative assessment" to determine the cause of the issue but didn't share further details.
Click to expand...

Press Release (April 25, 2019)

guest · Apr 27, 2019

Security breach shuts down network for Woodruff Arts Center, High Museum
April 26, 2019
https://www.wsbtv.com/news/local/at...or-woodruff-arts-center-high-museum/943823423

The Woodruff Arts Center says it is investigating a security breach after an unauthorized third party caused a massive network outage, affecting many of the center's operations and systems.
The Alliance Theatre, the Atlanta Symphony Orchestra and the High Museum of Art were all affected by the breach.

“Upon learning of the incident, we immediately took steps to secure our systems and began working to implement enhanced security measures. Our team also began an investigation and an outside forensics firm was engaged to assist us,” the center said in a news release Friday.
Click to expand...

The notice on their site does not explicitly state that this was a ransomware attack, but from their updated notice, it sounds like it might be.

guest · Apr 30, 2019

LockerGoga Ransomware Family Used in Targeted Attacks
April 29, 2019
https://securingtomorrow.mcafee.com...a-ransomware-family-used-in-targeted-attacks/

Once again, we have seen a significant new ransomware family in the news. LockerGoga, which adds new features to the tried and true formula of encrypting victims’ files and asking for payment to decrypt them, has gained notoriety for the targets it has affected.

Based on our research, and compared with other families, it has a few unique functions and capabilities that are rare compared to other ransomware families that have similar objectives and/or targeted sectors in their campaigns.

In order to uncover its capabilities, we analyzed all the samples we found, discovering similarities between them, as well as how the development lifecycle adds or modifies different features in the code to evolve the ransomware in a more professional tool used by the group behind it. [...]
Click to expand...

We did not see any spreading method used to deliver LockerGoga so it would be fair to assume it is used in targeted campaigns after the attackers had access to the system.
Click to expand...

guest · Apr 30, 2019

New Sodinokibi Ransomware Delivered via Oracle WebLogic Flaw
April 30, 2019
https://www.securityweek.com/new-sodinokibi-ransomware-delivered-oracle-weblogic-flaw

The ransomware, named Sodinokibi, is designed to encrypt files and delete backups in an effort to prevent victims from recovering their files without paying a ransom.

Talos researchers were the ones who spotted Sodinokibi being delivered via the recently fixed WebLogic Server flaw. Deploying ransomware via a vulnerability in WebLogic Server can be highly efficient as, unlike in the case of other attack vectors, no user interaction is required.
According to Talos, the attackers used PowerShell commands to download and execute their malicious files. Talos and others pointed out that the ransomware is designed to allocate a unique alphanumeric extension to encrypted files on each compromised system.

“We find it strange the attackers would choose to distribute additional, different ransomware on the same target. Sodinokibi being a new flavor of ransomware, perhaps the attackers felt their earlier attempts had been unsuccessful and were still looking to cash in by distributing Gandcrab,” Talos researchers explained.
Click to expand...

guest · Apr 30, 2019

Ryuk Ransomware:
Watertown newspaper hacked, cannot print Sunday editions
April 28, 2019
https://cnycentral.com/news/local/watertown-newspaper-hacked-cannot-print-sunday-editions

The Watertown Daily Times is working to fix a computer glitch, and hopes to have a hybrid Sunday-Monday edition printed shortly, according to the publisher.

The paper reports on its website that the virus, which left only the calling card “Ryuk: Balance of the Shadow Universe,” is the same one that crippled Tribune Publishing in December, according to published reports. It also crippled the data infrastructure of Stewart, Fla. on April, 13.
Click to expand...

Watertown Daily Times: Cyber attack disrupts Sunday paper delivery

guest · May 1, 2019

Cleveland officials plead ignorance on airport ransomware incident, local media unimpressed
April 30, 2019
https://statescoop.com/cleveland-of...-ransomware-incident-local-media-unimpressed/

Officials in Cleveland said Monday that a cyberattack that disrupted a handful of systems at the city’s airport last week was the result of ransomware. But the city is still having difficulty explaining the nature of the attack to the public.

Robert Kennedy, Cleveland’s director of port control, said at a press conference Monday that the FBI confirmed to the city just that morning that the malware responsible for the airport cyberattack was, indeed, a form of ransomware.
When local reporters accused Kennedy and other city officials of dodging questions about a ransom, Kennedy insisted he and his colleagues had not seen a demand for payment to recover their affected files, but that if they had, they would not have paid.

But the Monday press conference turned testy at moments as reporters continued to pepper Kennedy and Phillips about why the airport hack was not identified as ransomware sooner.
“There was never an intention to mislead the media,” she said. “I don’t know about you, but we’re not experts in this and that’s why we engaged the FBI.”
Click to expand...

guest · May 1, 2019

Windows Server hosting provider still down a week after ransomware attack
A2 Hosting has yet to fully restore services after a week, angering tens of customers
May 1, 2019
https://www.zdnet.com/article/windo...week-after-ransomware-attack/#ftag=RSSbaffb68

A ransomware infection has crippled the operations of a US-based web hosting provider for almost eight days now, several of the company's disgruntled customers have told ZDNet today.
CUSTOMERS LOSING MONEY
The infection, which took place last week on April 23, has led to a week-long downtime that A2 staff has struggled to fix, leading to an unending stream of complaints and desperate pleas for help from customers bleeding money with each passing day of downtime.

"Since the hack, A2 has provided zero information regarding my websites and database. I mean nothing, zero, zilch. I have been left to wait for an hour on hold calling support, to be told we understand your frustrations, but we cannot give you an ETA. They have this ridiculous update page, where nothing of substance is posted."
These complaints were similarly echoed by tens of other customers on social media, over the past week [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].
GLOBEIMPOSTER 2.0 IS THE MOST LIKELY SUSPECT
Based on currently available information, the ransomware infection appears to have snuck into A2's network via its Singapore-based data center and later spread to other Windows Server instances, also impacting the company's US operations.
Click to expand...

guest · May 2, 2019

Victims of ZQ Ransomware can decrypt their files for free
May 1, 2019
https://securityaffairs.co/wordpress/84768/malware/zq-ransomware-decryptor.html

Good news for the victims of the ZQ Ransomware, security experts at Emisisoft have released a free decryptor tool that allows them to decrypt files for free.
ZQ Ransomware infected users in the US, India, Polland, Brazil and the UK.

In order to decrypt the files, victims need to provide an encrypted file and original file to decrypt. The Decryptor tool is available at the following link:
https://www.emsisoft.com/decrypter/zq
Click to expand...

guest · May 2, 2019

'Ransomware' hits Telangana, AP power utilities
May 2, 2019
https://www.deccanherald.com/national/ransomware-hits-telangana-ap-power-utilities-731810.html

A malicious software has attacked the computer systems of Telangana and Andhra Pradesh State power utilities, police said on Thursday.
All the servers were down, and work has begun to rectify the glitch, which would be restored perhaps by Friday, they said. 'Ransomware' has attacked the systems, police said.

A staff of the Power Distribution Company of Telangana received a mail from an unknown person and the staff inadvertently clicked on it and the virus attack took over the entire systems, they said.
Along with the Telangana systems, the computer systems of power utilities in Andhra Pradesh also came under the malware attack because it is linked with each other, the official said.
Click to expand...

guest · May 2, 2019

Decryptor for MegaLocker and NamPoHyu Virus Ransomware Released
May 2, 2019
https://www.bleepingcomputer.com/ne...ocker-and-nampohyu-virus-ransomware-released/

Emsisoft has released a decryptor for the MegaLocker and NamPoHyu Virus ransomware that has been targeting exposed Samba servers. Victims can now use this decryptor to recover their files for free.

Once downloaded, make sure you have an Internet connection and then start the decryptor. Once started, browse to and select a ransom note and the decryptor will attempt to recover your decryption key.
Ransomware dev not happy
When we told victims to not pay for the ransomware, the developer was obviously not happy.
In a series of posts to our MegaLocker topic in the forums, the ransomware developer threatened to double the ransom amounts if a decryptor was not released within a week.
Click to expand...

Emsisoft Decrypter for MegaLocker

guest · May 3, 2019

The Week in Ransomware - May 3rd 2019 - Hello Dear Friend!
May 3, 2019
https://www.bleepingcomputer.com/ne...in-ransomware-may-3rd-2019-hello-dear-friend/

Yes, I know this week's title is a bit strange, but so are the comments made by ransomware devs in their ransom notes. Yes, a ransom note said "Hello dear friend!"

This week was an interesting week as we saw more ransomware being released that is targeting the enterprise, such as the Sodinokib Ransomware and MegaCortex. We also have good news as a decryptor for the MegaLocker and NamPoHyu Virus Ransomware were released. Serves them right for calling us devils!

Other than that, it was your normal week of new variants being released for existing ransomware such as Dharma and STOP Djvu.[...]
Click to expand...

guest · May 4, 2019

“MegaCortex” ransomware wants to be The One
May 3, 2019
https://news.sophos.com/en-us/2019/05/03/megacortex-ransomware-wants-to-be-the-one/

The convoluted infection methodology MegaCortex employs leverages both automated and manual components, and appears to involve a high amount of automation to infect a greater number of victims.

The attack was triggered, in at least one victim’s environment, from a domain controller inside an enterprise network whose administrative credentials the attacker seems to have obtained, in what appears to be a hands-on break in.
The digitally-signed executable payload used to perform the encryption has been signed by a certificate with an identical Common Name (CN) as signed executables we’ve found that date back to November, 2018 [...]
How MegaCortex strikes
[...] there seems to be a correlation between the MegaCortex attacks and the presence on the same network of both Emotet and Qbot (aka Qakbot) malware.
As the attack seems to indicate that an administrative password was abused by the criminals, we also recommend the widespread adoption of two-factor authentication for everything that currently requires just a password, and can use 2FA.
Click to expand...

guest · May 7, 2019

Baltimore City Hall Computer Network Infected With Ransomware Virus, Officials Say
May 7, 2019
https://baltimore.cbslocal.com/2019/05/07/baltimore-city-government-computer-virus/

Baltimore City Hall government servers have been infected by a ransomware virus that government officials said is spreading throughout their network.
Mayor Jack Young released a statement confirming the issue.

He said at this time no personal data has left their system.
Due to the current network issues, the Director of Public Works has suspended late water bill fees for City and County customers, DPW said in a tweet
Newly sworn in City Council president Brandon Scott tweeted a statement on the IT issues as well.

My statement on IT Issues pic.twitter.com/7VKfmNpbYP
— Brandon M. Scott (@CouncilPresBMS) May 7, 2019
Click to expand...

guest · May 7, 2019

Analyzing Potter County entities affected by ransomware
May 7, 2019
https://abc7amarillo.com/news/local...ention-center-been-affected-by-the-ransomware

ABC 7 News recently found out Potter County’s issue with computers was ransomware instead of a computer virus.
This has affected both the Potter County Sheriff’s Office operations and the inmates at the detention center who are working to get their GED.

“We were just told not to turn the computers on for a while until they could go through and scan everything, so over the last week, we’ve been able to get our email back up and we do have internet access,” said Potter County Sheriff Brian Thomas.
But, a valuable lesson was learned, Sheriff Thomas says whether it’s your email at work or even at home.
“If you don’t know where it's coming from and it’s got an attachment on it, my suggestion is don’t open it,” said Thomas.
Click to expand...

Potter County Judge Nancy Tanner confirmed to us the malware is in fact ransomware. Judge Tanner said this is day 17 dealing with the ransomware problem, and the malware has likely been in the county's computer system since January. https://t.co/3NHUnRhtvu

— KAMR Local 4 News (@KAMRLocal4News) May 7, 2019
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches