Ransomware and Recent Variants

guest · Aug 28, 2019

Ransomware attack hits New Kent Co. Public Schools ahead of new school year
August 27, 2019
https://wtkr.com/2019/08/27/ransomw...t-co-public-schools-ahead-of-new-school-year/

New Kent County Public Schools were subjected to a ransomware cyber attack, the school district’s superintendent announced Tuesday.
In a message to families, Brian J. Nichols said the files located on the district’s internal hard drive have been encrypted, meaning they are unable to access the files without paying a ransom. He says this “will cause an undue burden as we work to start school on time and ready for our students to learn.”

New Kent County Public Schools will open on time, and open house events will continue as scheduled. School officials will work through the registration process, bus routing and will make sure students are scheduled for their classes on the first day of school.
Below is Nichols’ full statement on the incident: [...]
Click to expand...

guest · Aug 28, 2019

Report: 70 percent of ransomware attacks in 2019 hit state and local governments
August 28, 2019
https://statescoop.com/report-70-pe...acks-in-2019-hit-state-and-local-governments/

More than two-thirds of all publicly known ransomware attacks in the United States in 2019 have hit state or local governments, according to a report published Wednesday by the IT security firm Barracuda Networks.

In total, Barracuda said the the 55 attacks against state and local governments reported between January and July that it analyzed accounted for about 70 percent of all ransomware incidents against U.S. targets.

“Smaller towns are often more vulnerable because they lack the technology or resources to protect against ransomware attacks,” the report reads.
While Barracuda’s report concludes with the usual recommendations for government IT officials — updating aging operating systems, installing firewalls and blacklisting malicious IP addresses — the ransomware threat shows now signs of slowing down.
Click to expand...

guest · Aug 28, 2019

Targeted cyber attacks, including ransomware, on the rise
August 28, 2019
https://www.computerweekly.com/news...yber-attacks-including-ransomware-on-the-rise

Targeted cyber attacks accounted for 59% of all attacks in the second quarter of this year, up from 47% in the first quarter, a report has revealed.
Governments and healthcare organisations emerged as prime targets of ransomware attacks, according to the latest quarterly cyber threat report by security firm Positive Technologies.

Leigh-Anne Galloway, cyber security resilience lead at Positive Technologies, said: “Companies often store large databases with personal data and credentials of their clients, and criminals are also interested in usernames and passwords of the employees of target companies.
Governments were the targets of 62% of malware infections, up from 44% in the previous quarter, with governments most frequently hit by ransomware, the report said.

But despite ransomware attacks disabling their IT infrastructure, authorities in the US cities of Lake City and Riviera Beach, for example, reportedly paid ransoms of $600,000 and $530,000, respectively.
Click to expand...

Positive Technologies: Ransomware strikes entire cities

guest · Aug 28, 2019

The Great, Big Ransomware Revival
August 28, 2019
https://www.infosecurity-magazine.com/news/the-great-big-ransomware-revival/

Yesterday McAfee Labs released a report on the cyber-threat landscape during the first quarter of 2019 and the stats are pretty scary. Researchers recorded a worrying 118% growth in new ransomware samples, along with innovative changes in the codes and tactics used to execute it.

While spear-phishing remained popular, the ransomware currently going through a resurgence increasingly targets exposed remote access points like Remote Desktop Protocol (RDP).
McAfee researchers also observed actors behind ransomware attacks using anonymous email services to manage their campaigns rather than the traditional approach of setting up command-and-control (C&C) servers.
Click to expand...

McAfee Labs Threats Report Q1 2019: New threats statistics represent growing trends in attacks
(PDF - 1.68 MB): https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-aug-2019.pdf

guest · Aug 29, 2019

Ransomware Attack Targets Wolcott Public Schools
The school district’s computer system was attacked with ransomware at the end of the last school year, according to district officials
August 28, 2019
https://www.nbcconnecticut.com/news...Targets-Wolcott-Public-Schools-558610611.html

As kids head back to the classroom in Wolcott, the district is trying to get all of their computers back from hackers.

Wolcott Superintendent Anthony Gasper said the school district’s computer system was attacked with ransomware at the end of the last school year. According to the school’s superintendent, the staff was unable to access all of their internal files to get the data back. The Wolcott School District was asked to pay the hackers a ransom.

In the Republican American, he said, “Every computer in the district, every server, every network switch. It basically meant that every file that was stored on a network drive or a hard drive was locked."
Click to expand...

ronjor · Aug 29, 2019

Ransomware Bites Dental Data Backup Firm

PerCSoft, a Wisconsin-based company that manages a remote data backup service relied upon by hundreds of dental offices across the country, is struggling to restore access to client systems after falling victim to a ransomware attack.
Click to expand...

guest · Aug 29, 2019

Ashland city government recovering from cyberattack
August 29, 2019
https://www.komu.com/news/ashland-city-government-recovering-from-cyberattack

The city government in Ashland is still recovering from a cyber hack that occurred Wednesday.
The attack prevented city officials from accessing any of the city's network systems and data. The Ashland Interim City Administrator said staff came to work in the morning and realized they were locked out of their network.

In fact, several Columbia businesses fell victim to a similar attack.
Rob Smith, designated broker at Weichter Real Estate, previously told KOMU 8 News that his office had a similar experience when everyone arrived to work.

“Once we get back restored a hundred percent," he said. "We will have a pretty good conversation not only with city staff here, but also with our technology vendor to figure out what can we do to make sure this does not happen again.”
In the mean time, St. Romaine said the city still does not have access to its data. The hack has also forced some residents to pay utility bills in person, which are done online.
Click to expand...

guest · Aug 30, 2019

A Look Inside the Highly Profitable Sodinokibi Ransomware Business
August 30, 2019
https://www.bleepingcomputer.com/ne...ly-profitable-sodinokibi-ransomware-business/

Relatively new on the ransomware scene, Sodinokibi has already made impressive profits for its administrators and affiliates, some victims paying as much as $240,000, while a network infection netted $150,000 on average.
Setting the rules of the game
Since its discovery in April, Sodinokibi (a.k.a. REvil) has become prolific and quickly gained a reputation among cybercriminals in the ransomware business and security researchers.
Advertisements for the new file-encrypting malware started in early July on at least two forums. UNKN said that they were looking to expand their activity and that it was a private operation with "limited number of seats" available for experienced individuals.

For those affiliates who can infect an entire network, the REvil/Sodinokibi developers allow a victim to purchase a decryption tool for the entire fleet of affected computers. According to forum post shared with BleepingComputer, these network-wide decryptors have an average cost of $150,000.
Click to expand...

guest · Aug 31, 2019

Nampa School District sees steady progress in cyberattack recovery
August 30, 2019
https://www.idahopress.com/news/loc...cle_cf3cb657-baf6-52cf-87c1-7492deeff5c7.html

Nampa School District officials hope to have usable computers to all of their employees in the next couple of days following a malware attack from last week.

The school district was hit by a malware attack on Aug. 21, leading to a network shutdown and loss of internet access at all schools. School has remained in session since, and district spokeswoman Kathleen Tuck said officials are working on changing passwords and re-imaging the affected devices.
The district distributed some unaffected laptops and Wi-Fi hotspots to schools last week. After working through the weekend, technology specialists were able to give school administrators access to some records, Tuck said.
Click to expand...

Idaho schools under ransomware attack. Will ransomware make America great again? (August 23, 2019)

The most recent incident was reported in the Nampa Idaho school district, whose officials have revealed a serious cyberattack that managed to disrupt the functions of the entire school district network last Wednesday morning, mentioned information security specialists.

Michael Conner, the district’s superintendent, mentioned that it was a ransomware infection, adding that authorities were not planning to pay any ransom. “We are working with specialists to determine how hackers entered our systems; we will also implement a recovery process as soon as possible.” To date, two of Middletown’s six computer systems continue to operate with multiple limitations.
Click to expand...

guest · Sep 2, 2019

Sodinokibi Ransomware Spreads via Fake Forums on Hacked Sites
September 2, 2019
https://www.bleepingcomputer.com/ne...ware-spreads-via-fake-forums-on-hacked-sites/

A distributor for the Sodinokibi Ransomware is hacking into WordPress sites and injecting JavaScript that displays a fake Q & A forum post over the content of the original site. This fake post contains an "answer" from the site's "admin" that contains a link to the ransomware installer.
How the fake Questions and Answers overlay attack works
BleepingComputer was first alerted to this new attack method by Aura, who has seen multiple victims become infected via this method. Below we will provide a general overview of how this attack works and the process used to install the Sodinokibi, or REvil, Ransomware.
Click to expand...

guest · Sep 2, 2019

Hacker paralyses Dubai firm’s computer systems, seeks ransom
Attack renders computers useless: Ask for money to get machines up and running again
September 1, 2019
https://gulfnews.com/uae/crime/hacker-paralyses-dubai-firms-computer-systems-seeks-ransom-1.66144036

A Dubai-based contracting firm has been left crippled after being locked out of its own computer systems by a hacker, who is now demanding $300 in bitcoins to get the infected machines up and running again.
Mohammad Ibraheem, who works for a contracting company in Dubai Silicon Oasis, said the ransomware attack took place four days ago when the hacker infected their computers with the dreaded crypto virus, Dharma, which has left all their files encrypted.

“We don’t know what to do and low long this siege will last. We have tried everything, but nothing seems to work. I have spoken to IT experts in the UAE and India but no one has been able to help. All our computers have been rendered useless,” said the exasperated Indian expat from Puducherry.
No decryptor released
There is no Dharma decryptor released to the public yet from any anti-virus company and there is no known method at this time to decrypt files encrypted by any of the newer variants of Dharma.

"We have been advised not to give into the blackmail as there is no guarantee that he will keep his words. So for now we are not paying him anything, instead trying to figure out a solution,” he said.
Click to expand...

guest · Sep 2, 2019

hawki said: ↑

"Ransomware Hits Georgia Court System

News reports have confirmed the Georgia court system has been struck with a ransomware attack, which has resulted in at least part of its digital information systems being taken offline.

An investigation is now underway; it remains unclear how many systems were compromised..."

https://www.darkreading.com/document.asp?doc_id=1335099&_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple
Click to expand...

Cyber Attack Causes Problems to Trion
September 1, 2019
https://sky21.com/2019/09/cyber-attack-causes-problems-to-trion/

The Town of Trion is just one of many jurisdictions across the state that lost all of its municipal court records, which has caused problems in bringing cases to court.
This past week, the Atlanta Journal Constitution quoted Trion Town Clerk Julie Stephens. “It’s been crippling. We lost all of our information”, Stephens told the AJC. Trion is not alone, the City of Summerville is also reeling from the loss of municipal court records that were kept online.

A cyber attack in late June infiltrated the record-keeping system that was provided free by the State of Georgia. Experts with the state tried to fix the problem, but to no avail. The result is municipal courts like Trion’s and Summerville’s are now having to go back to the old-fashioned way of keeping paper records until new computer systems can be obtained.
On June 28, 2019 the Administrative Office of the Courts experienced the cyber attack, causing the major disruption.

All told, 30 Magistrate Courts and 23 Municipal Courts were using systems victimized by the cyber attack, Bruce Shaw, the AOC’s spokesman, said. Seventeen probate courts were also impacted.
Click to expand...

guest · Sep 3, 2019

Nemty Ransomware Gets Distribution from RIG Exploit Kit
September 3, 2019
https://www.bleepingcomputer.com/ne...mware-gets-distribution-from-rig-exploit-kit/

The operators of Nemty ransomware appear to have struck a distribution deal to target systems with outdated technology that can still be infected by exploit kits.
Nemty is all RIGged up
Nemty appeared on the radar towards the end of August, although the malware administrators made it known on cybercriminal forums long before this date.

Security researcher Mol69 noticed that the file-encrypting malware is now a payload in malvertising campaigns from RIG exploit kit (EK).
The malware used the .nemty extension for the encrypted files but the variant observed by Mol69 adds '._NEMTY_Lct5F3C_' at the end of the processed files.
Click to expand...

guest · Sep 3, 2019

Update on Baltimore’s ransomware attack
September 2, 2019
https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/baltimore-recovery-update/

Baltimore city officials last week agreed to transfer $6 million from a fund for parks and public facilities to help cover “remediation and hardening” costs associated with a May 2019 ransomware attack, according to The Baltimore Sun.
In addition, Baltimore officials last month said they are considering purchasing cyber insurance, The Baltimore Sun reported. The proposed cyber insurance policy would cost $830,000 and provide $20 million in cyber liability coverage.
[/quot]
Click to expand...

Minimalist · Sep 3, 2019

Is ransomware driving up the price of Bitcoin?

Cybercriminals may be partially responsible for driving up the price of Bitcoin.

It’s no secret that Bitcoin and other cryptocurrencies have had an enabling effect on cybercrime. Now, we believe the inverse may also be true – that cybercrime, and ransomware in particular, is helping stimulate the cryptocurrency economy and inflating the value of Bitcoin.
Click to expand...

https://blog.emsisoft.com/en/33977/is-ransomware-driving-up-the-price-of-bitcoin/

guest · Sep 3, 2019

Recent ransomware surge linked to Russian criminal group
September 3, 2019
https://statescoop.com/recent-ransomware-surge-russian-criminal-group/

A recent surge of ransomware attacks against local governments, law enforcement agencies and school systems across the United States can be traced to an increase in activity by a hacker group known to employ financial malware to take over targeted computer systems and extract large payments, according to cybersecurity firm CrowdStrike.

The activity comes from a Russia-based group CrowdStrike dubbed Wizard Spider, which operates a banking trojan known as TrickBot. That virus has been frequently associated with the Ryuk ransomware, which has been identified as the culprit in at least 13 public-sector cyberattacks since last October, including several that elicited six-figure payouts from local governments in Georgia, Florida, and Indiana, and most recently a school district in New York.

The first eight months of 2019 were particularly lucrative for the Ryuk malware’s authors.

“It’s been a heavy year of activity,” Meyers said. “They have some high likelihood of getting organizations to pay the ransom.”
Click to expand...

guest · Sep 3, 2019

Jackson Co. is preparing for a possible cyber attack
September 3, 2019
https://fox26medford.com/jackson-co-is-preparing-for-a-possible-cyber-attack/

Jackson County says it’s taking steps to prepare for a ransomware attack.

Jackson County Technology Director, Mark Decker, says the attacks are growing increasingly more sophisticated and damaging.
To defend against an attack, he says the county is making sure all of its software is up to date and is creating back up copies of its data.

Decker says the county was already the victim of a smaller-scale ransomware attack a few years ago, but he says they got lucky and didn’t have to pay the ransom.
Click to expand...

guest · Sep 4, 2019

JSWorm: The 4th Version of the Infamous Ransomware
September 4, 2019
https://securityaffairs.co/wordpress/90811/malware/jsworm-4-ransomware-analysis.html

Despite the name could remind to JavaScript language and a possible “worm” logic, the malware does not include either of the two characteristics. [...]
Conclusion
The analyzed case has some features in common with most of the ransomware, including encryption scheme and the deletion of shadow copy and persistence. About the encryption scheme, the ransomware uses an AES key generated starting from an embedded Base64 seed which is converted into a byte array through CryptStringToBinaryA API. It is very common to find Ransomware relying on this library (CryptoAPI) for cryptographic task mainly for reliability and for reducing the time for development.

Another interesting element is the presence of a mutex containing the string “kto prochtet tot sdohnet =)” in Russian language. This leads us to think that the authors could have Russian hands. Obviously, this could also be a false flag, but the Russian underground have a long tradition in such kind of cyber-crime activities:
Click to expand...

Minimalist · Sep 4, 2019

Ransomware wreaks havoc in the South, generates $1 million for hackers

Cities across the Southern states have been crippled by ransomware in recent weeks. In many cases, city leaders have had no choice but to give in to the attackers’ demands.

In this article, we’re going to take a look at how these attacks work and the damage they’ve caused local municipalities.
Click to expand...

https://blog.emsisoft.com/en/33797/...in-the-south-generates-1-million-for-hackers/

guest · Sep 4, 2019

NY School Delays Start of Year After Ransomware Attack
September 3, 2019
https://www.nbcnewyork.com/news/loc...f-Year-After-Ransomware-Attack-559322971.html

A school in Orange County was all set to welcome students back from summer vacation on Wednesday, but a ransomware attack has delayed the start of the school year.

The Monroe-Woodbury Central School District sent out an email to parents Tuesday night, saying they had experienced a “cyber security threat” that impacted the district’s operations.
The school will hold an unplanned “Superintendent’s Conference Day” on Tuesday, and apologized to parents for the unforeseen and late change.

The district said that they although they do not know how long it will take to restore what was affected in the hack — mostly because they are still unsure of the full extent of the attack — they will still be welcoming students back on Thursday, Sept. 5.
Click to expand...

guest · Sep 4, 2019

Criminals launch cyber attack at Plymouth school 'in return for ransom'
September 4, 2019
https://www.plymouthherald.co.uk/news/plymouth-news/criminals-launch-cyber-attack-plymouth-3282812

Parents and students have been placed on alert after a Plymouth school fell victim to a major cyber assault at the hands of UK criminals.
Hele's School in Seymour Road, Plympton, suspects malware experts targeted its systems with a 'Ransomware attack' - a virus used by gangs or individuals to disable vital data until a ransom is handed over.

The alarming revelation was revealed by Principal Justine Mason in an open newsletter to families in the first week of the new autumn term.
Most of the database containing student and teacher documents has been recovered, she said.

However, any documents saved on the school network since May 1 will have been encrypted - they are no longer accessible and there is no chance of recovering these documents.
The school says IT chiefs will continue to upgrade their systems - though this work is 'time consuming and complex'.
Click to expand...

guest · Sep 5, 2019

Ransomware Adopts DoppelPaymer Name Given by Researchers
September 5, 2019
https://www.bleepingcomputer.com/ne...dopts-doppelpaymer-name-given-by-researchers/

In July, researchers from CrowdStrike reported that two different ransomware infections were being operated under the same BitPaymer name. After analyzing the ransomware, it was discovered that there were both code, ransom note, and payment portal similarities between the two ransomware variants.
This led CrowdStrike to believe that a threat actor from the INDRIK SPIDER cybercrime group, who created BitPaymer, splintered off and created their own ransomware variant.

"Both BitPaymer and DoppelPaymer continue to be operated in parallel and new victims of both ransomware families have been identified in June and July 2019. The parallel operations, coupled with the significant code overlap between BitPaymer and DoppelPaymer, indicate not only a fork of the BitPaymer code base, but an entirely separate operation. [...]"

While it is always fun when a malware adopts a name or logo that a reporter or researcher creates, it is an important reminder that while we are watching the threat actors, they are watching us too!
Click to expand...

guest · Sep 5, 2019

mood said: ↑

Server hack delays Houston County Schools’ start date
July 25, 2019
https://www.dothaneagle.com/news/ed...cle_6e28738c-af06-11e9-bbf0-13920c892c35.html
Click to expand...

Houston County Schools still recovering from malware attack
September 5, 2019
https://www.wtvy.com/wrgx/content/n...recovering-from-malware-attack-559436611.html

Just over a month ago, the Houston County School system was attacked by malware. Students have been back in the classroom for a month while they work to get all computers back online.
The I.T. department is going school to school to bring them back up.

They want to make sure each school is secure before they leave, since the hack caused some security issues as well.
With school right around the corner in late July, Houston County Schools administrators and teachers had to set things up without any working computers.
Click to expand...

Minimalist · Sep 5, 2019

Students Rejoice: School District Closed by Ransomware Attack

The summer school holiday has not ended for students in Flagstaff, Arizona, as a ransomware attack hitting the School District computers forces the decision to cancel classes for today. The schedule for tomorrow is uncertain.
Click to expand...

https://www.bleepingcomputer.com/ne...-school-district-closed-by-ransomware-attack/

Minimalist · Sep 6, 2019

Lilocked Ransomware Actively Targeting Servers and Web Sites

A relatively new ransomware named Lilocked by researchers and Lilu by the developers is actively targeting servers and encrypting the data located on them. All of the known infected servers are web sites, which is causing the encrypted files to show up in Google search results.
Click to expand...

https://www.bleepingcomputer.com/ne...are-actively-targeting-servers-and-web-sites/

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches