Ransomware and Recent Variants

Minimalist · Aug 20, 2019

To pay or not to pay ransomware: A cost-benefit analysis of paying the ransom

As ransomware continues to rattle the world, organizations are slowly tightening up their security practices in an effort to stop ransomware at the point of infection.

But here’s the thing: there’s no system on the planet that is 100 percent secure.

If you’ve been infected with ransomware, you’re left with one very difficult decision: should you pay the ransom?
Click to expand...

https://blog.emsisoft.com/en/33686/...a-cost-benefit-analysis-of-paying-the-ransom/

JRViejo · Aug 20, 2019

Twenty-three towns in Texas had their computer systems hacked and their data held hostage in a large-scale coordinated ransomware attack August 16, the Texas Department of Information Resources said in a statement.
Click to expand...

23 towns in Texas were hit by possibly the largest-ever ransomware attack, in what could be the first coordinated cyberattack of its kind by Antonio Villas-Boas.

guest · Aug 20, 2019

NPCC approves return of Eurofins after cyber-attack
August 20, 2019
https://www.fsmatters.com/NPCC-approves-return-Eurofins-after-cyber-attack

The ransomware attack - targeting parent company Eurofins Scientific - affected the IT systems of its forensics subsidiary, which is based in the UK and is one of the primary forensic service providers (FSPs) to UK policing.

Following weeks of sustained effort by the NPCC, Eurofins, the Home Office, the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC), the NPCC Lead for the Forensic Marketplace, Assistant Chief Constable Paul Gibson, has recommended Eurofins can resume operational work on behalf of policing.

“It has taken weeks of concerted effort across government, law enforcement and the company themselves to achieve this extremely positive step forward,” said ACC Gibson.
Weeks of reduced capacity has meant that backlogs of approximately 15,000 samples have built up across the country, but Eurofins’ return will allow the marketplace to gradually build back to the strength it was before the cyberattack took place.

“We will continue to monitor and assess the impact on the marketplace,” said ACC Gibson, “but the backlogs held by forces will be cleared over the weeks to come as we start to gradually restore capacity.
Click to expand...

guest · Aug 21, 2019

Threat Intelligence Notification: GermanWiper Ransomware
August 20, 2019
https://www.carbonblack.com/2019/08...lligence-notification-germanwiper-ransomware/

GermanWiper Ransomware was found distributed via spam email campaign in Germany. It’s a data-wiping malware and the ransom note was written in German language. The malware pretends to be ransomware but is actually a wiper that destroys the data instead of encrypting it.

The detailed analysis of this malware is underway and a link will be found here once completed.
Unlike ransomware that encrypts data, German Wiper will overwrite the data content with null values and append five randomly generated characters as file extension to the wiped file.
After that, it will perform the deletion of volume shadow copies and disable Windows automatic startup repair to ensure all the data cannot be restored easily with the following command:
Click to expand...

Minimalist · Aug 21, 2019

Hackers Want $2.5 Million Ransom for Texas Ransomware Attacks

The threat actor that hit multiple Texas local governments with file-encrypting malware last week may have done it by compromising a managed service provider. The attacker demanded a collective ransom of $2.5 million, the mayor of a municipality says.

New details from the Department of Information Resources (DIR) announce that the number of victims has been established to 22, with evidence pointing to a single party responsible for the attacks.
Click to expand...

https://www.bleepingcomputer.com/ne...-million-ransom-for-texas-ransomware-attacks/

Minimalist · Aug 21, 2019

The Texas Ransomware Attacks: A Gamechanger for Cybercriminals

Security researchers worry that this weekend’s coordinated attacks on more than 20 Texas governments mark a change in how ransomware attacks will be launched in the future.
Click to expand...

https://threatpost.com/the-texas-ransomware-attacks-a-gamechanger-for-cybercriminals/

ronjor · Aug 21, 2019

While one Texas county shook off ransomware, small cities took full punch

Sean Gallagher - 8/21/2019
Lubbock County managed to isolate the attack quickly. Others, not so much.
Click to expand...

guest · Aug 22, 2019

Glenwood schools recover from cyber-attack for new school year
August 21, 2019
https://www.wowt.com/content/news/G...er-attack-for-new-school-year--557751991.html

The school year for the Glenwood District is off to a challenging start as schools recover from a cyber-attack back in July.
The district’s superintendent Devon Embray, explains that while several servers were hit, the attack will not impact the students.

According to school officials, the attack seemed to encrypt their servers, denying access to any of them. Upon further investigation, it was determined that the system was hit with ransomware and the information was being held, hostage.

“We were kind of dead in the water, we had nowhere of going until we had that information up and running. That server controlled all of our student’s information, schedules, everything we were needing to start the year. For about a week and a half we were shut down and unable to move,” said Embray.
It was just two years ago the district decided to purchase insurance to guard against cyber-attacks. The insurance company was able to negotiate the ransom from $15,000 to $10,000.
Investigators believe the attack was foreign and not domestic.
Click to expand...

Minimalist · Aug 22, 2019

Did you get hacked by the new Fortnite ransomware? This is how you fix it

Yet, fortunately, even if you do get infected, you aren’t entirely powerless; the research team says it believes it is possible for victims to recover deleted files due to the “ simple method used to delete the files”.
Click to expand...

https://www.siliconrepublic.com/enterprise/fortnite-ransomware-hack-cheat-tool-fix

hawki · Aug 22, 2019

Minimalist said: ↑

The Texas Ransomware Attacks: A Gamechanger for Cybercriminals

https://threatpost.com/the-texas-ransomware-attacks-a-gamechanger-for-cybercriminals/
Click to expand...

"Ransomware Attacks Are Testing Resolve of Cities Across America...

An F.B.I. warning sent to key players in the American cyberindustry on Monday left unclear who was responsible for the malware afflicting Texas, a strain first seen in April and named Sodinokibi...

In the 22 Texas attacks, according to several experts who have been called in, the pathway appeared to be through a once-trusted communications channel often used by law enforcement agencies, and managed by a private systems-management firm. Getting inside a channel shared by so many Texas localities meant the hackers had to target only one system, which ushered them into municipal networks across the state. Once inside, it was fairly easy to deploy software that encrypts a town’s data...

'We see some evidence that there is specific targeting of organizations that have insurance,' said Kimberly Goody, a manager of financial crimes analysis for FireEye,...

According to government and private experts, the ransomware business is now proving so lucrative that the hackers are pouring some of their profits back into their own research and development, making their attacks more precise, and more wily...

[Texas]...State officials said a “single threat actor,” which could be a group, was behind the cyberattack,..."
Click to expand...

https://www.nytimes.com/2019/08/22/us/ransomware-attacks-hacking.html

guest · Aug 22, 2019

Cohuna man loses thousands in cyber attack
August 22, 2019
https://www.riverineherald.com.au/news/2019/08/22/768814/cohuna-man-loses-thousands-in-cyber-attack

A COHUNA man lost thousands of dollars after his laptop was hacked.

The matter was reported to police on Tuesday, with the matter now in the hands of Swan Hill Criminal Investigation Unit.
Investigators have been told the first the man knew of it was when he tried to open a document and it was locked with a message asking for cash to release it, which is called ransomware.

Sergeant Andrew Rigg of Cohuna police said the victim had been diligent and recognised the issue immediately, limiting his losses.

"It is a timely reminder that all information stored on electronic devices that access the internet are subject to the possibility of such attacks," he said.
Click to expand...

guest · Aug 22, 2019

mood said: ↑

Georgia State Patrol agency infected with ransomware
July 29, 2019
https://www.scmagazine.com/home/sec...state-patrol-agency-infected-with-ransomware/
Click to expand...

Georgia Police Agencies Still Struggling After Cyberattack
August 22, 2019
https://www.govtech.com/security/Georgia-Police-Agencies-Still-Struggling-After-Cyberattack.html

State law enforcement officials are turning back to old-fashioned methods of getting their jobs done as they deal with the aftermath of a cyberattack.
Georgia State Patrol Troopers and Motor Carrier Compliance Division officers have been on the road without computers or license plate scanners for nearly a month now.

Reached by email Tuesday, the FBI declined to provide answers to questions about the hack, including what, if any, progress had been made on the investigation and if any other government agencies have reported attacks using the same ransomware.
Stallings said there is no estimate for how long it will take or how much money it will cost to decrypt all the files. There also is no word on whether the department will be able to retrieve all the encrypted data, what kinds of data have been compromised or how many devices were affected.

“It’s just a really, really slow process,” Stallings said. “They’ve been scanning laptops, desktops, jump drives, external hard drives. We have lots of devices within the agency.”
Click to expand...

Minimalist · Aug 23, 2019

Ransomware continues assault against cities and businesses

Ransomware continues to make waves in the US, forcing multiple cities and organizations into tough choices. Pressed for cash and time, local government organizations are left with few options: Either pay the ransom as soon as possible and encourage criminals to continue bringing essential services to their knees, or refuse and be left with a massive cleanup bill.
Click to expand...

https://blog.malwarebytes.com/ranso...tinues-assault-against-cities-and-businesses/

guest · Aug 23, 2019

When Ransomware Cripples a City, Who’s to Blame? This I.T. Chief Is Fighting Back
August 22, 2019
https://www.nytimes.com/2019/08/22/us/florida-ransomware-hacking-it.html

The former information technology director of Lake City, the northern Florida city that was forced to pay out nearly half a million dollars after a ransomware attack this summer, was blamed for the breach, and for the long time it took to recover.
But in a new lawsuit, Mr. Hawkins said he had warned the city about its vulnerability long ago — urging the purchase of an expensive, cloud-based backup system that might have averted the need to pay a ransom.

But there was no money. And to those weighing the many competing priorities in the northern Florida city of 12,000 people, purchasing capacity on remote computer servers didn’t seem to rise to the top — at the time. Once the city’s entire computer network crumbled in the space of a few hours, there was an intense round of finger-pointing, and it ended with Mr. Hawkins.

“My name has been blasted all over the media and across the country for weeks,” he said in his first interview with the news media since the attack earlier this summer.
Click to expand...

guest · Aug 23, 2019

Cyber attack forces emergency shutdown of Lake County government servers
August 23, 2019
https://www.nwitimes.com/news/cyber...cle_a4b36fa8-61fa-5817-a243-a49c2982c1c8.html

Lake County has been hit with a cyber attack that forced the shutdown of email service and several internal applications throughout county government, officials said Friday.

Systems administrators first noticed the ransomware on some county computers Thursday afternoon, according to Mark Pearman, director of county's information technology office. To prevent the virus from spreading, IT staff began taking encrypted and unencrypted servers off the network “out of an abundance of caution,” he said.

“Our main effort right now is to mitigate the issue,” Pearman told The Times, adding that a preliminary investigation indicates the ransomware was hidden on county systems earlier this month and “sat there until now.”
Click to expand...

guest · Aug 24, 2019

MLSD details July cyber attack on district's network
August 23, 2019
https://www.columbiabasinherald.com...etails_july_cyber_attack_on_districts_network

It was a busy Thursday night meeting for the Moses Lake School Board as the board approved a new three-year teacher contract, outlined a new joint-initiative with the Port of Moses Lake, passed its $122.5 million 2019-2020 budget, and revealed details of a massive cyber attack on the district’s computer network in late July.
According to Marlon Howell, the district’s technology director, on July 22 the district got hit with Russian malware, which encrypted and locked the district’s servers and its online backups.

Howell said the district’s IT staff saw they were under attack and unplugged all of the district’s roughly 50 servers, but not before the malware’s author’s issued a ransom demand — $1 million to unlock each server and online backup.

“Someone in the Moses Lake School District clicked on a link in an email,” Howell told school board members. “The anti-malware system did not work, and we had to restore every server from backups.”
Instead of paying the ransom, Howell said the district blocked access to a number of overseas Internet Protocol (IP) addresses — particularly in Russia and China — and restored the servers from offline backups that were four-to-five months old.
Click to expand...

guest · Aug 25, 2019

Rockville Centre pays almost $100G to hackers after ransomware attack, officials say
August 24, 2019
https://www.newsday.com/long-island/education/hackers-ramsomware-school-districts-1.35422441

The Rockville Centre school district paid almost $100,000 to restore its data after being hacked with a ransomware virus that encrypted files on the system’s server until payment was made to unlock the information, officials said Friday.

The Nassau County district was among several statewide targeted by a ransomware virus that encrypts data, essentially locking users out of access to their files. Mineola's server was corrupted by the same ransomware, known as "Ryuk," but the district said it did not have to pay a ransom to unlock data because it had everything backed up offline.

"Look, nobody wants to pay anything, but if they encrypted the files and I don’t have access to them, it is difficult to run a school district without any historical data or emails, most of which were encrypted," Johnson said.
Click to expand...

Minimalist · Aug 26, 2019

Ransomware modifications double year-on-year in Q2 2019 - Kaspersky

Kaspersky researchers detected 16,017 new ransomware modifications in Q2 2019 – including ones belonging to eight new malware families.

This is more than double the number of new samples detected a year ago, in Q2 2018 (7,620).

The Kaspersky IT Threat Evolution Q2 2019 report also highlights that more than 230,000 users were attacked during the quarter, along with other key findings.
Click to expand...

https://securitybrief.co.nz/story/ransomware-modifications-double-year-on-year-in-q2-2019-kaspersky

Minimalist · Aug 26, 2019

New Nemty Ransomware Taunts Antivirus Solutions, May Use RDP

A new ransomware has been spotted over the weekend, carrying references to the Russian president and antivirus software. The researchers call is Nemty.

This is the first version of Nemty ransomware, named so after the extension it adds to the files following the encryption process.
Click to expand...

https://www.bleepingcomputer.com/ne...mware-taunts-antivirus-solutions-may-use-rdp/

guest · Aug 26, 2019

10 Simple Tips to Protect Your Organization from Ransomware
Enhance your dat-to-day security with ten easy tips
August 26, 2019
https://dzone.com/articles/10-simple-tips-to-protect-your-organization-from-r

Ransomware attacks on businesses and institutions are now the most common type of malware breach, as they account for 39% of all IT security incidents. Criminal ransomware revenues are projected to reach $11.5B by 2019. With a few simple policies and procedures, plus some cutting-edge endpoint countermeasures, you can effectively protect your business from any potential ransomware menace.

Most ransomware victims are ill-prepared to respond, often losing critical data even if they pay the ransom, meanwhile suffering business consequences like lost revenues, angry customers and damaged brand reputation. With a few simple precautions, plus robust risk management, you can protect your data and business in the most efficient, cost-effective way. [...]
Click to expand...

Minimalist · Aug 26, 2019

Emsisoft releases a free decryptor for the Syrk ransomware

The Emsisoft malware team has just released a new free decryption tool for the Syrk ransomware strain, which was first brought to our attention by @Leotpsc.

If you have been infected with this ransomware, please download the FREE decryption tool linked below and DO NOT PAY the ransom. A detailed guide is also included.
Click to expand...

https://blog.emsisoft.com/en/33885/emsisoft-releases-a-free-decryptor-for-the-syrk-ransomware/

guest · Aug 26, 2019

Ransomware threat raises National Guard's role in state cybersecurity
August 26, 2019
https://statescoop.com/ransomware-cybersecurity-state-government-national-guard-role/

National Guard units already play a large role in state governments’ cybersecurity activities, such as protecting election systems, but the threat of ransomware to cripple a state or city organization is a growing concern for uniformed personnel, the top military official overseeing the National Guard across the United States said.

Lengyel said he could not provide any updates on either the Texas or Louisiana attacks, but noted both states’ governors called their National Guards “almost immediately” after the first ransomware infections were detected.

“What we bring in is generally expertise and knowledge and cyber skills,” the general said, noting that many members of National Guard cyber units have day jobs in IT or software development.
“National Guard members can go on-site,” he said. “They have several goals. One is to try to find out where [the attack is] coming from, help salvage the IT systems that were impacted, and get things back up and running.”
Click to expand...

guest · Aug 27, 2019

Mineola schools recovering from ‘malware attack’
August 27, 2019
https://theislandnow.com/williston-110/mineola-schools-recovering-from-malware-attack/

The Mineola school district said that it is beginning to recover from a cyberattack that crippled its network, but no sensitive data was compromised. Superintendent Michael Nagler warned that Mineola will not be the last district to be attacked.

“We have been victims of a malware attack on our computer network,” Nagler said at a Board of Education meeting last Thursday. “And it is affecting all of our equipment, so we’re slowly but surely bringing things back to a clean network.”
In January, Nagler said, a district employee downloaded a virus onto a computer and it began to develop.
“Slowly, but surely, that virus sat on the PC and made its way into our network with the intention of looking for vulnerabilities in our network to exploit,” Nagler said. It sat on the network for six months after that, Nagler said.

The “ransomware” encrypted all data on the network and locked all employees out and in order to get back in the district would have to pay to ransom. Nagler said the district did not entertain paying ransom for the network.
Nagler said he believes that Mineola will not be the last district to suffer from this cyberattack.
Click to expand...

guest · Aug 27, 2019

The Epidemic Analysis of Ransomware in July 2019
August 27, 2019
https://blog.360totalsecurity.com/en/the-epidemic-analysis-of-ransomware-in-july-2019/

According to the report data, the trend of ransomware diversification was obvious in July, and 29 different families of ransomware emerged one after another. Among them, the GlobeImposter family won the top spot with 21.21% of the list, and the two major families of phobos and Stop together cast three dominant positions.

In terms of the proportion of infected systems, Windows 7, Windows 10 and Windows Server 2008 have become attack breakthroughs. Among them, the proportion of Windows 7 climbed significantly, from the 29.49% in June to 56.45% in July, becoming the “most vulnerable” in the month. [...]
Click to expand...

Minimalist · Aug 28, 2019

Ransomware has evolved into a serious enterprise threat

Ransomware has seen a resurgence since the start of 2019, with cyber criminals changing code and tactics to target enterprises and local authorities for higher ransom payments, McAfee researchers warn
Click to expand...

https://www.computerweekly.com/news...-has-evolved-into-a-serious-enterprise-threat

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

JRViejo Super Moderator

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

hawki Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

JRViejo Super Moderator

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

hawki Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches