Ransomware and Recent Variants

guest · Sep 6, 2019

The Week in Ransomware - September 6th 2019 - Three Week Roundup
September 6, 2019
https://www.bleepingcomputer.com/ne...omware-september-6th-2019-three-week-roundup/

This week's article includes the stories from the last three weeks as I was unable to do the two previous ones.

Over the past three weeks, we have seen a lot of attacks on schools, local government entities, and MSPs by the REvil and Ryuk crews. These targets tend to pay large ransoms through insurance and thus are prime targets for the ransomware affiliates and developers.
In addition we have also seen a lot of new STOP and Dharma variants released over the past two weeks. Unfortunately, STOP changed the encryption method, so Michael Gillespie's decryptor will no longer function after its last update. [...]
Click to expand...

guest · Sep 6, 2019

No Ransom Paid in Recent Attack, Texas Says
September 6, 2019
https://www.securityweek.com/no-ransom-paid-recent-attack-texas-says?

The incident took place on August 16, when more than 20 Texas local governments reported being infected as part of a coordinated assault. A total of 22 towns were identified as impacted by the attack.
The State Operations Center (SOC) was activated later that morning and, by August 23, all affected entities were already recovering, with business-critical services restored, DIR says.

“By day four, response teams had visited all impacted sites and state response work had been completed at more than 25% of those sites. One week after the attack began, all sites were cleared for remediation and recovery,” DIR said in a statement published on Thursday.

Previous reports suggested that the attackers might have asked for $2.5 million in exchange for the decryption keys that would provide access to the encrypted data, but DIR says no money has been paid to restore impacted systems.

“DIR is unaware of any ransom being paid in this event,” the statement reads.
Click to expand...

DIR: Update on Texas Local Government Ransomware Attack (September 5, 2019)

guest · Sep 7, 2019

Akamai: Fortnite ransomware scams should force developers and gamers to think about security
September 7,2 019
https://venturebeat.com/2019/09/07/...evelopers-and-gamers-to-think-about-security/

The game industry has long been a target for cybercriminals, and so it was no surprise in the past couple weeks to see the discovery of ransomware that attacks the accounts of Fortnite players.

Cybersecurity firm Cyren found a free game hack tool, Syrk, that players download as a way to cheat in the game. But they discover it disables malware defenses and then deletes batches of the users’ files and encrypts them. To un-encrypt them, the player has to pay to receive a password.
Gaming is a target because that’s where the money is today. I recently spoke about this with Nelson Rodriguez, global director of media industry strategy at Akamai. [...]
Click to expand...

Minimalist · Sep 8, 2019

Fake PayPal Site Spreads Nemty Ransomware

A web page pretending to offer an official application from PayPal is currently spreading Nemty ransomware to unsuspecting users.
Click to expand...

https://www.bleepingcomputer.com/news/security/fake-paypal-site-spreads-nemty-ransomware/

guest · Sep 9, 2019

mood said: ↑

Cyber attack forces emergency shutdown of Lake County government servers
August 23, 2019
https://www.nwitimes.com/news/cyber...cle_a4b36fa8-61fa-5817-a243-a49c2982c1c8.html
Click to expand...

Lake County, Ind., Sheriff’s Email Online After Cyberattack
September 9, 2019
https://www.govtech.com/security/Lake-County-Ind-Sheriffs-Email-Online-After-Cyberattack.html

More than two weeks after a cyber attack on the Lake County, Ind., Government Center forced a shutdown of email service and internal applications, the county police email is back up and running, officials said.

Pearman said as for the other email systems still down, the IT department is hoping to restore them by Monday or early next week. Without email, Lake County employees have been relying on “phone, faxes and the shoe leather express,” Larry Blanchard, an assistant to the Lake County commissioners previously told The Times.
Pearman said the 3,000 desktop computers and 50 to 60 servers were not infected by the ransomware's attack.

"There is currently an electronic investigation to see where it came from and how we got it,” Pearman said. “We got lucky with just the email being affected.”
Click to expand...

Minimalist · Sep 9, 2019

Exploit Kits Target Windows Users with Ransomware and Trojans

Over the weekend and into today, four different malvertising campaigns have been redirecting users to exploit kits that install password stealing Trojans, ransomware, and clipboard hijackers.

All four of these campaigns were discovered by exploit kit expert nao_sec and are being distributed through malvertising that redirect visitors to the exploit kits landing pages. These landing pages are typically hosted on hacked sites.
Click to expand...

https://www.bleepingcomputer.com/ne...et-windows-users-with-ransomware-and-trojans/

guest · Sep 9, 2019

RPS 205: Ransomware caused outages, could last days
September 9, 2019
https://www.wifr.com/content/news/RPS-205-Ransomware-caused-outages--559844901.html

Rockford Public Schools Dist. 205 confirms a ransomware attack caused the widespread outages that began Friday.
The district is not sharing a dollar amount or how the system was hacked.

In a letter to staff and parents, the district says the outages to the digital and electronic systems could last several more days.

"The electronic and digital systems outage districtwide will continue this week and could last several days. The outage was triggered by ransomware, and we’re working with our Information Technology team and an outside computer forensics firm to restore access.
The outage includes our Internet and information systems. Phone access at our schools has been intermittent. Like last week, we’re rerouting any down phone lines to working lines, so parents/guardians are still able to contact schools via phone. [...]"
Click to expand...

guest · Sep 10, 2019

mood said: ↑

Houston County Schools still recovering from malware attack
September 5, 2019
https://www.wtvy.com/wrgx/content/n...recovering-from-malware-attack-559436611.html
Click to expand...

Houston County School Board hears proposal for new cyber security after malware attack
September 9, 2019
https://www.wtvy.com/content/news/H...-security-after-malware-attack-559897281.html

The Houston County School District may be making some changes to cyber security.
https://media.graytvinc.com/images/690*387/hcs+board.JPG
This comes in light of a malware attack in July that the system is still recovering from.

Panell proposes a two phase approach to beefing up the school system's security - response to the current breach and building a program to "plug the holes".
Security isn't cheap however - the service would cost the school system just under $13,000 a month.

"98% start with the persistence of email, so that's the first point of attack,” said Panell. “That's where we launch a lot of our defenses."
Click to expand...

guest · Sep 10, 2019

Souderton Area School District Contending With Ransomware Cyberattack
September 10, 2019
https://6abc.com/souderton-area-school-district-contending-with-ransomware-cyberattack/5528824/

The Souderton Area School District has become the most recent apparent victim of a ransomware cyberattack that struck soon after the beginning of the new school year.
Officials from the district have been working with the FBI, the Department of Homeland Security, the Secret Service, and a cyber-security firm to remedy the situation.
School district officials have not revealed the full extent of this cyber-attack, but they did say their financial systems are stored off-site so the district's financial information remains secure.

Meanwhile, Souderton Schools Superintendent Dr. Frank Gallagher released a statement reading, in part, that as a necessary precaution the district, "...immediately shut down the district-wide computer network and disabled internet connections to prevent further damage."
Click to expand...

guest · Sep 10, 2019

Hackers target Wakulla Schools, shut down district-wide emails in ransomware attack
September 10, 2019
https://eu.tallahassee.com/story/ne...s-shuts-down-district-wide-emails/2275809001/

Hackers are holding the Wakulla County School District computers hostage.
Tuesday morning, the district announced it was “experiencing a disruption” in its information systems due to ransomware, and can no longer communicate via email.

Officials say the attack began last week and that state and federal law enforcement have been notified.

“After discovering the attack, we immediately launched an investigation with the assistance of a leading forensic firm, and we have been working diligently to secure our systems and bring them back online,” the district posted on its Facebook page.
Click to expand...

guest · Sep 11, 2019

mood said: ↑

Ransomware Attack Targets Wolcott Public Schools
The school district’s computer system was attacked with ransomware at the end of the last school year, according to district officials
August 28, 2019
https://www.nbcconnecticut.com/news...Targets-Wolcott-Public-Schools-558610611.html
Click to expand...

Ransomware Attack Hits School District Twice in 4 Months
September 10, 2019
https://www.securityweek.com/ransomware-attack-hits-school-district-twice-4-months

A Connecticut school district's teachers are working without computer access less than a week after a second malware attack targeted the district's servers

The Republican American reports the district shut any computers connected to the Wolcott school district networks Sept. 4 after a staff member reported suspicious activity on a district computer.
The district was the victim of a three-month ransomware attack this summer that blocked all five Wolcott schools from accessing internal files, as well as staff in the central office and business office.
Click to expand...

guest · Sep 11, 2019

Baltimore CIO, Who Managed Ransomware Response, on Leave
September 10, 2019
https://www.govtech.com/people/Baltimore-CIO-Who-Managed-Ransomware-Response-on-Leave.html

Frank Johnson, Baltimore's IT director who managed the city's response to the catastrophic ransomware attack earlier this year, is on leave, according to reports and a city official.

"All I can say is that Frank is on leave and that Todd as the deputy is taking over day-to-day operations," he said.
Carter, who joined the city a mere day before it was thrown into chaos by the May attack, will now be responsible for daily operations — including those related to the city's ongoing recovery process, Bentley said.
The city itself is still recovering from the May attack, though things are much better than several months ago when numerous bill pay systems were paralyzed and a majority of the city's staff didn't have computer access, Bentley said.

"We're not at 100 percent, but I think we're pretty close. I know the investigation is still ongoing, but we have the majority of our applications and everybody's back online," he said
Click to expand...

guest · Sep 11, 2019

mood said: ↑

Server hack delays Houston County Schools’ start date
July 25, 2019
https://www.dothaneagle.com/news/ed...cle_6e28738c-af06-11e9-bbf0-13920c892c35.html
Officials can't confirm county school system hack isn't ransomware (July 26, 2019)
Click to expand...

School board looking at cyber security options after malware attack
September 10, 2019
https://www.wsfa.com/2019/09/10/school-board-looking-cyber-security-options-after-malware-attack/

Several Houston County schools are still working to get everything restored after July’s cyber security breach.

Superintendent David Sewell confirms Ashford Elementary, Webb Elementary, Rehobeth Elementary and Rehobeth Middle still face internet issues. While teachers and office personnel have access to internet outside the school system’s network, students don’t. The system is still working to bring all of the cafeterias back online. Sewell expects that to be complete by next week.
As work continues at schools, the system is working to prevent something like this from happening again.
Click to expand...

guest · Sep 11, 2019

Baltimore acknowledges for first time that data was destroyed in ransomware attack
September 11, 2019
https://www.baltimoresun.com/politi...0190911-i6feniyk5nd3pereznpdxwsf7a-story.html

Baltimore’s auditor said Wednesday that IT department performance data was lost when hackers locked city files in May — the first disclosure of data being destroyed in the attack.

Auditor Josh Pasch told the mayor and other top city officials at a meeting of the city’s spending board that without the data his team has been unable to check some claims the department made about its performance. The data was stored locally and not backed up.

“Our recommendation to BCIT for this was to go ahead and revisit and implement a backup system,” Pasch told the board.
It’s not clear how much data might have been permanently lost as a result of the attack.
Click to expand...

Minimalist · Sep 11, 2019

Ryuk Related Malware Steals Confidential Military, Financial Files

A new malware with strange associations to the Ryuk Ransomware has been discovered to look for and steal confidential financial, military, and law enforcement files.
Click to expand...

https://www.bleepingcomputer.com/ne...steals-confidential-military-financial-files/

Minimalist · Sep 12, 2019

The new target that enables ransomware hackers to paralyze dozens of towns and businesses at onced

Cybercriminals are zeroing in on the managed service providers that handle computer systems for local governments and medical clinics.
Click to expand...

https://www.rawstory.com/2019/09/th...lyze-dozens-of-towns-and-businesses-at-onced/

guest · Sep 12, 2019

mood said: ↑

Rockville Centre pays almost $100G to hackers after ransomware attack, officials say
August 24, 2019
https://www.newsday.com/long-island/education/hackers-ramsomware-school-districts-1.35422441
Click to expand...

Suffolk County, N.Y., to Discuss Hacking During Summit
September 11, 2019
https://www.govtech.com/security/Suffolk-County-NY-to-Discuss-Hacking-During-Summit.html

The summit, to be held Oct. 16, was organized partly in response to the Rockville Centre school district paying nearly $90,000 in July to hackers who encrypted files on the system’s server until payment was made to unlock the information. The other district, Mineola, was corrupted by the same ransomware, known as "Ryuk," but the district did not have to pay a ransom to unlock data because it had everything backed up offline.

"The fact of the matter is that security breaches against local municipalities and school districts are becoming more frequent, jeopardizing critical data and controls that threaten the everyday lives of our residents,” he said.
The summit is expected to cover the cybersecurity threats local governments face, along with opportunities and resources that are available to school districts, towns, villages and counties to protect themselves.
Click to expand...

hawki · Sep 12, 2019

"The New Target That Enables Ransomware Hackers to Paralyze Dozens of Towns and Businesses at Once

Cybercriminals are zeroing in on the managed service providers that handle computer systems for local governments and medical clinics..."

Long Read:

https://www.propublica.org/article/...ralyze-dozens-of-towns-and-businesses-at-once

Minimalist · Sep 12, 2019

Radio broadcaster Entercom hit with ransomware attack, reports say

A ransomware attack launched last week against Philadelphia-based radio conglomerate Entercom Communications resulted in the disruption of email service and crashed computers, according to media reports.
Click to expand...

https://www.cyberscoop.com/entercom-ransomware-attack-radio-hack/

guest · Sep 14, 2019

The Week in Ransomware - September 13th 2019 - Exploit Kits
September 13, 2019
https://www.bleepingcomputer.com/ne...-ransomware-september-13th-2019-exploit-kits/

This week was your standard mix of new variants of existing ransomware and new ransomware families being released.

In addition, numerous exploit kits were detected pushing ransomware and other malware as well as increased distribution of Nemty through a fake PayPal site. Of particular interest is a data exfiltration Trojan that contains numerous references to Ryuk. [...]
[(quote]
Click to expand...

Minimalist · Sep 14, 2019

New Fake 'Eva Richter' Resume Spam Aims to Destroy Files

A new spam campaign is underway that pretends to be a job application from "Eva Richter" who is sending her photo and resume. This resume, though, is actually an executable masquerading as a PDF file that destroys a victim's files by installing the Ordinypt Wiper.
Click to expand...

https://www.bleepingcomputer.com/ne...va-richter-resume-spam-aims-to-destroy-files/

guest · Sep 14, 2019

Nemty Ransomware Update Lets It Kill Processes and Services
September 14, 2019
https://www.bleepingcomputer.com/ne...e-update-lets-it-kill-processes-and-services/

Nemty ransomware is under active development, although its version number may not show it. Its authors are clearly making efforts to make it a more efficient and sophisticated malware and it begins wider distribution.
Process and service killer
Despite making changes to the code, Nemty authors kept the same version number, shows an analysis from security researcher Vitali Kremez. The code, however, shows modifications that make the ransomware more aggressive in its actions.

A look at Nemty's new code reveals a set of nine targeted processes, which include WordPad, Microsoft Word, Excel, Outlook Thunderbird email clients, SQL, and the VirtualBox software for running virtual machines.
With SQL and VirtualBox on the list, it gives us a clue that Nemty is targeting corporate victims.
More countries on the "no-no" list
Kremez also observed that the 'isRu' check has now extended to more countries. The full list now including Russia, Belarus, Kazakhstan, Tajikistan, Ukraine, Azerbaijan, Armenia, Kyrgyzstan, and Moldova, with the last four being the latest additions.
Click to expand...

guest · Sep 14, 2019

mood said: ↑

City of Albany Hit in Ransomware Attack
Few details yet on the March 30 ransomware attack
April 1, 2019
https://www.darkreading.com/attacks-breaches/city-of-albany-hit-in-ransomware-attack/d/d-id/1334308
Click to expand...

Albany spent over $300K recovering from cyberattack
September 13, 2019
https://wnyt.com/news/albany-spent-over-300k-recovering-from-cyberattack/5491067/

On Friday, officials with the city of Albany spoke about the amount spent in response to the ransomware attack that took place in March.
A FOIL request submitted to the city was answered on Friday. Earlier this month, NewsChannel 13 inquired about the amount of funds used to cover overtime for employees working to re-enter lost data, hardware and software system upgrades, credit monitoring services for city employees and professional cybersecurity services.

Those costs total a little over $161,000. However, at an event Albany Mayor Kathy Sheehan said they've spent well over $300,000 in response to the attack. NewsChannel 13 asked city hall for a complete breakdown of those costs, but did not hear back on Friday.
The city still hasn’t said how much ransomware hackers were demanding when they locked up all their systems in late March.

"Every year, you have unexpected events. Sometimes, it's a catastrophic storm, this past year it was an unexpected ransomware attack," Sheehan said. “We have made investments well over $300,000 in investments that we had to make as a result of that. Investments to rebuild what we had and investments to make sure but it doesn't happen again."
Click to expand...

guest · Sep 16, 2019

Irish government admits ransomware breach
September 15, 2019
https://www.thetimes.co.uk/edition/ireland/irish-government-admits-ransomware-breach-s8n6nxpgj

The Department of Communications, Climate Action and the Environment, which is responsible for protecting the state against cyber-attacks, has admitted its IT systems were breached in a ransomware attack last year.

Richard Bruton, the communications minister, revealed the attack in response to a parliamentary question from Jack Chambers, the Fianna Fail spokesman on defence, who had raised concerns about the government’s approach to cyber-security. Chambers has questioned why the National Cyber Security Centre (NCSC) comes under the remit of Bruton’s department as it has no security, intelligence or defence capabilities.
Bruton said the ransomware had been identified, isolated and removed.
Click to expand...

guest · Sep 16, 2019

School district computers paralyzed in attack
Second ransomware attack this year
September 15, 2019
https://www.neagle.com/news/20190913/school-district-computers-paralyzed-in-attack

The second major cyber attack this calendar year against the computer systems of Wallenpaupack Area School District, led to a shut down of all 3,000 or so computers district-wide.

They were still working to slowly restore the compromised servers the day after the school board meeting.
As he told the board and in a letter posted the next day for parents and guardians, and district staff, there was no breach of personal information about individual students or employees.

In all, the district has approximately 3,000 computers and 400 printers. When the servers first went down, personnel were directed to shut down every computer in every building, to help prevent the virus from spreading.
The district is forwarding information to the FBI CYWTACH team which is investigating these incidents in an effort to stop this criminal activity. Silsby said that it was not believed that the hacker(s) were local. Rather, he said it may be that the source of the attacks is in “another country.”
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches