Ransomware and Recent Variants

guest · Oct 10, 2019

Nemty Ransomware Decryptor Released, Recover Files for Free
October 10, 2019
https://www.bleepingcomputer.com/ne...re-decryptor-released-recover-files-for-free/

Victims of the Nemty Ransomware finally have something to be happy about as researchers have released a decryptor that allows them to recover files for free.

Since August 2019, the Nemty Ransomware has been utilizing a variety of distribution methods [1, 2, 3] to infect victims and encrypt their files.
The good news is that victims finally get to fight back as researchers from the security firm Tesorion have created a decryptor that works on Nemty versions 1.4 and 1.6, with 1.5 coming soon.
Decrypting Nemty encrypted files
Tesorion provided BleepingComputer with their decryptor so that we would test its ability to decrypt Nemty encrypted files and in our tests it was able to decrypt most of the more common file types that people commonly use such as Office documents, videos, and images.

Once a file is uploaded, Tesorian's servers will compute the decryption key for the uploaded file and send it back and load into the decryptor.
Click to expand...

Tresorion:
A decryptor for the Nemty ransomware based on analysis of its cryptography
Nemty update: decryptors for Nemty 1.5 and 1.6

Minimalist · Oct 11, 2019

Emsisoft releases new decryptor for Muhstik ransomware

We just released a new decryption tool for the Muhstik ransomware strain. You can download the FREE decryption tool linked below. A detailed guide is also included.
Click to expand...

https://blog.emsisoft.com/en/34312/emsisoft-releases-new-decryptor-for-muhstik-ransomware/

guest · Oct 11, 2019

Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
October 11, 2019
https://www.bleepingcomputer.com/ne...ware-released-and-pushed-via-rig-exploit-kit/

The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware.

First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are still utilizing Internet Explorer and Flash Player.
If a user running these outdated programs are redirected to the exploit kit landing page, the malicious scripts will attempt to exploit vulnerabilities in the browser to install a variety of malware including the Nemty 1.6 ransomware.

According to security firm Tesorion, Nemty 1.6 also modified their encryption algorithm to use the Windows cryptographic libraries instead of their own custom AES implementation.
Click to expand...

guest · Oct 11, 2019

The Week in Ransomware - October 11th 2019 - Decryptors Released!
October 11, 2019
https://www.bleepingcomputer.com/ne...omware-october-11th-2019-decryptors-released/

We had some interesting news this week, such as the HildaCrypt ransomware releasing their keys, RobbinHood Ransomware bragging about their past exploits, a Muhstik Ransomware victim hacking back and stealing the decryption keys, and a Nemty decryptor being released.

While decryptors were being released, unfortunately we saw new variants of existing ransomware being released for Dharma, Nemty, Phobos, and STOP. We also saw the Ouroboros Ransomware dev fix the weakness in their encryption algorithm so that BloodDolly's decryptor no longer works.
Ultimately, I still count this as a win this week! [...]
Click to expand...

guest · Oct 12, 2019

The Epidemic Analysis of Ransomware in September 2019
October 12, 2019
https://blog.360totalsecurity.com/en/the-epidemic-analysis-of-ransomware-in-september-2019/

According to 360 Brain of Security monitoring, in the past September, although the spread of some virus families decreased slightly, the overall proportion remained high. At the same time, the spread of Phobos and GlobeImposter families keep incraesing. Nemty ransomware variants reproduction cause big loss to user’s wealth.
GlobeImposter family
From the analysis of the proportion of the extortion virus family this month, the Stop family of the perennial tyrants is “slightly tired”, which is 12.24 percentage points lower than that of the previous month, but the overall traffic still leads the list with 22.90%. Closely followed are GlobeImposter family and phobos family, the amount of transmission has been steadily improved, and gradually narrowed to the top of the list, the two major ransomvirus family accounted for 21.72% and 20.55%.
Click to expand...

guest · Oct 14, 2019

Mailing services firm Pitney Bowes says it suffered malware attack, shares down
October 14, 2019
https://www.reuters.com/article/us-...ered-malware-attack-shares-down-idUSKBN1WT1QM

Mail management company Pitney Bowes Inc said on Monday a malware attack encrypted information on some of its systems and disrupted customer access to certain services, sending its shares down 4%.
The company said it had seen no evidence that customer or employee data has been improperly accessed.
Click to expand...

guest · Oct 14, 2019

M6, one of France's biggest TV channels, hit by ransomware
October 14, 2019
https://www.zdnet.com/article/m6-on...v-channels-hit-by-ransomware/#ftag=RSSbaffb68

The M6 Group, France's largest privately-owned multimedia group, was the victim of ransomware over the weekend, but none of the company's TV and radio channels suffered any downtime.

The incident took place on Saturday morning, according to a message the company posted on its official Twitter account.
The M6 Group said they managed to contain the infection with the help of its cybersecurity staff, preventing any downtime to any of its ten TV channels, radio stations, and film studios.

However, according to French newspaper L'Express, the company did not escape the incident unscathed, with phone lines and email servers still being down today, on Monday.In hindsight, the French TV station dodged a major bullet and should be thanking its staff for the prompt response that limited the ransomware's impact.
Click to expand...

guest · Oct 15, 2019

JRViejo said: ↑

23 towns in Texas were hit by possibly the largest-ever ransomware attack, in what could be the first coordinated cyberattack of its kind by Antonio Villas-Boas.
Click to expand...

Texas Chief Information Officer Shares Lessons Learned from Ransomware Attack
October 15, 2019
https://www.nextgov.com/cybersecuri...res-lessons-learned-ransomware-attack/160598/

The 23 Texas municipalities affected by a ransomware attack over the summer did not take proper cybersecurity precautions, making them vulnerable to intrusion while other government entities were protected, according to the state’s chief information officer.

Hackers went after a managed service provider that contracted with the municipalities but were only able to infiltrate those 23 networks, but not all of the provider’s customers, said Todd Kimbriel, the Texas Chief Information Officer.

“These 23 organizations were impacted because they failed to follow good cyber hygiene,” said Kimbriel, discussing the incident during the annual National Association of State Chief Information Officers convention in Nashville.
Based on his experience with the July cyberattack, Kimbriel advised other states to think about how they would scale up their response based on the number of entities affected.
“What are you going to do if you get 100 locations?” Kimbriel said. “The numbers and the ability to scale is really critical and from a planning perspective you have to think about how you will be able to do that.”
Click to expand...

guest · Oct 15, 2019

Alphabroder Suffers Ransomware Attack
The promo products industry’s largest supplier said it was hit by SODINOKIBI malware
October 14, 2019
https://www.asicentral.com/news/new...r-2019/alphabroder-suffers-ransomware-attack/

Updated 1:26 p.m. ET, October 15, 2019:
On Tuesday morning, alphabroder gave an update that indicated progress had been made. Still, the struggle against the malware was ongoing. The company said: “As of now, we have restored alphabroder.com functionality and are taking orders via alphabroder.com – our phone and email systems are still affected by this incident [...] We will provide updates as we have any relevant information to share.”
Click to expand...

Alphabroder (asi/34063), the largest supplier in the North American promotional products industry, said Monday that it has been the victim of a cyberattack.

Headquartered in suburban Philadelphia, the firm said in an initial statement issued Monday that it’s been hit by a strand of ransomware known as SODINOKIBI.

“No customer data or account information has been compromised or is accessible by this malware,” alphabroder said in an official statement, which acknowledged that its shipping and processing platform has been affected.
Speaking to Counselor, Clifton emphasized that alphabroder had recommended security protocols in place, from firewalls to disaster recovery to various other protective systems. “Unfortunately, it’s a sophisticated malware, and was able to work around those protections,” Clifton told Counselor.

With reported North American promotional product revenue of $1.64 billion, alphabroder is the largest supplier in the industry, according to Counselor’s most recent rankings.
Click to expand...

Minimalist · Oct 16, 2019

Ransomware statistics for 2019: Q2 to Q3 report

Ransomware attacks continued to become more focused and sophisticated in Q2 and Q3 2019. In contrast to the spray-and-pray campaigns of the past, threat actors are increasingly targeting larger and more profitable targets such as businesses, schools and government organizations.
Click to expand...

https://blog.emsisoft.com/en/34335/ransomware-statistics-for-2019-q2-to-q3-report/

guest · Oct 16, 2019

South Knox School Corporation recovers from malware virus
October 16, 2019
https://www.mywabashvalley.com/news/south-knox-school-corporation-recovers-from-malware-virus/

South Knox School Corporation has restored all servers after being hit by a ransomware virus late Friday afternoon.

According to SKSC Superintendent Tim Grove, approximately 50 out of over 400 computers were infected by the virus.
Grove says the SKSC technology department “went to work immediately to minimize damage to computers, servers and programs”.

Grove says no personal and/or sensitive information appears to have been compromised.
Click to expand...

guest · Oct 16, 2019

Baltimore belatedly buys cyberinsurance
October 16, 2019
https://www.scmagazine.com/home/security-news/data-breach/baltimore-belatedly-buys-cyberinsurance/

In what could be the poster child case for closing the barn door after the horse has left, the Baltimore City Council has approved the purchase of cyber insurance, six months after the municipality suffered a damaging ransomware attack.

The Baltimore Sun reported the city conducted a bidding process and selected two plans. “The first plan, for $10 million in liability coverage from Chubb Insurance, will cost $500,103 in premium. The second, for $10 million in excess coverage, will be provided by AXA XL Insurance for $335,000,” the Sun wrote.
Each plan has a $1 million deductible.
Click to expand...

guest · Oct 17, 2019

Ransomware Remains Biggest Cyber Threat To SMBs, Warns Datto
October 17, 2019
https://www.silicon.co.uk/security/cyberwar/ransomware-biggest-threat-smbs-297021

American cybersecurity and data backup Datto has warned that the biggest threat to small-to-medium-sized businesses (SMBs) is ransomware.

Its fourth annual Global State of the Channel Ransomware report surveyed more than 1,400 managed service providers (MSPs), and found that SMBs have become a prime target for ransomware criminals.
Ransomware threat
The Datto report found that ransomware attacks are pervasive, and the number of ransomware attacks against SMBs is on the rise.
It found for example that eighty-five percent of MSPs reported attacks against SMBs over the last two years, compared to 79 percent of MSPs who reported the same in 2018.

The average cost of that downtime is $141,000, a more than 200 percent increase over last year’s average downtime cost of $46,800.
The report also uncovered that the cost of downtime is now 23 times greater than the average ransom request of $5,900.
Click to expand...

Datto Global Survey Uncovers Business Impact and Increasing Frequency of Ransomware Attacks

guest · Oct 17, 2019

mood said: ↑

Mailing services firm Pitney Bowes says it suffered malware attack, shares down
October 14, 2019
https://www.reuters.com/article/us-...ered-malware-attack-shares-down-idUSKBN1WT1QM
Click to expand...

Pitney Bowes Says Disruptions Caused by Ryuk Ransomware
October 17, 2019
https://www.securityweek.com/pitney-bowes-says-disruptions-caused-ryuk-ransomware

The company informed customers on Monday that some services had been unavailable due to a piece of ransomware that encrypted files on some systems. I an update shared on Thursday, the company described the security incident as “the Ryuk virus malware attack.”

The incident impacted the company’s mailing services, customer account access, the supplies web store, Software and Data Marketplace downloads, and some commerce services.
Pitney Bowes says it has made significant progress in restoring affected systems, and many services are now fully functional.
Click to expand...

guest · Oct 18, 2019

Emsisoft releases new decryptor for STOP Djvu ransomware
October 18, 2019
https://blog.emsisoft.com/en/34375/emsisoft-releases-new-decryptor-for-stop-djvu-ransomware/

While STOP (Djvu) may not be as well known as Ryuk and Sodinokibi, with 160 variants, more than 116,000 confirmed victims and an estimated total of 460,000 victims, it is by far the most active and widespread ransomware today. But there’s good news. We’ve just released a free decryption tool for it.

We’ll be breaking STOP’s encryption via a side-channel attack on the ransomware’s keystream. As far as we know, it’s the first time this method has been used to recover ransomware-encrypted files on such a large scale.
Our free decryption tool helps victims to unlock their files without paying the ransom, and can be downloaded from the Emsisoft Decryption Tools page linked below.
Click to expand...

Note: A decryptor for STOP Puma is also available here

Emsisoft Decryptor for STOP Puma
The STOP Puma ransomware encrypts victim's files and appends the extension ".puma", ".pumas", or ".pumax" to files. Other supported extensions also include ".INFOWAIT" and ".DATAWAIT".
Click to expand...

Download:
STOP Djvu Decryptor: https://www.emsisoft.com/ransomware-decryption-tools/download/stop-djvu
STOP Puma Decryptor: https://www.emsisoft.com/ransomware-decryption-tools/download/stop-puma

guest · Oct 18, 2019

REvil Ransomware Affiliates Partner with Corporate Intruders
October 18, 2019
https://www.bleepingcomputer.com/ne...-affiliates-partner-with-corporate-intruders/

Experienced network intruders and ransomware groups have struck an alliance helping each other monetize their skills by spreading malware to company networks.
One access-as-a-service provider works with multiple ransomware collectives, including REvil/Sodinokibi, offering them access to large targets.
Symbiotic relationship
High-profile ransomware actors like REvil focus on companies and are in constant need of new victims to keep the business humming.

One particular hacker called -TMT- has been working with REvil operators since August 2019. The actor already had experience with this since they collaborated with other ransomware teams before, Yelisey Boguslavskiy, director of security research, writes in a report today.
Both Lalartu and -TMT- discovered the benefits of collaborating with ransomware groups and offered their services to high-profile syndicates.
Click to expand...

Buyers don't have to pay for full access. The hacker told AdvIntel that they were willing to upload malware into the system, or to open a single server access session for a lower price. This is an offer he makes to ransomware collectives, too.

AdvIntel's research also details the tactics, techniques, and procedures used by -TMT-, which include using Metasploit and the Cobalt Strike pentesting platform.
Click to expand...

guest · Oct 18, 2019

Italians Rocked by Ransomware
October 18, 2019
https://www.infosecurity-magazine.com/news/italians-rocked-by-ransomware/

Italy is experiencing a rash of ransomware attacks that play dark German rock music while encrypting victims' files.
The musical ransomware, called FTCode, was detected by security analysts at AppRiver in malicious email campaigns directed at Italian Office 365 customers.

"The .vbs file initially launches PowerShell to download and play an mp3 file from archive.org. At first glance, we suspected it was just a renamed file extension for malware, a common practice to help evade some network gateways. However, we were amused to find it launches a Rammstein song mix," wrote AppRiver researchers.
In an attempt to establish trust with the user and show that decryption is actually possible, the onion site offers the visitor a chance to test file decryption with one file before they pay the full ransom.
The cost of the ransom is set at $500 if paid within the first three days, after which it rapidly increases to $25,000.
Click to expand...

AppRiver: FTCode Ransomware Drops, Rocks, & Locks Files

guest · Oct 18, 2019

Maze Ransomware Now Delivered by Spelevo Exploit Kit
October 18, 2019
https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/

The Spelevo exploit kit has been spotted by security researchers while infecting victims with Maze Ransomware payloads via a new malicious campaign that exploits a Flash Player use after free vulnerability.
Maze Ransomware, a variant of Chacha Ransomware, was initially found by Malwarebytes security researcher Jérôme Segura in May.

The researcher found that the ransomware was being distributed using the Fallout exploit kit via a fake site camouflaged as a legitimate cryptocurrency exchange app.
New Maze Ransomware campaign
Exploit kit expert nao_sec was the first to spot the new Maze Ransomware campaign yesterday, with GrujaRS also taking a closer look at it one hour later.
At this time, there is no way to decrypt for free the files that Maze Ransomware encrypts. If anything changes, we will publish a new article with additional findings.
Click to expand...

guest · Oct 18, 2019

Ransomware Attack Reportedly Hits Practice Management Company, Locking Lawyers Out of their Case Files
October 17, 2019
https://www.lexblog.com/2019/10/17/...pany-locking-lawyers-out-of-their-case-files/

The case management software company TrialWorks was reportedly hit by a ransomware attack, shutting down its platform for at least four days and locking some lawyers out of their case files.

According to the TechBento blog, the attack started last Sunday and lasted at least through yesterday. I have not been able to confirm with the company if the situation has been resolved. One customer on Twitter told me as of 8:49 p.m. ET on Oct. 17 that her firm was still unable to access their files.
I have attempted to reach executives at the company to learn more about the status of the system.
Click to expand...

guest · Oct 18, 2019

Report: RCC cyber attack was first successful of this scale at NC community college
October 18, 2019
https://www.yourdailyjournal.com/ne...cessful-of-this-scale-at-nc-community-college

The cyber disturbance that temporarily took out all of Richmond Community College’s internet-based services in July and apparently stunted the college’s fall enrollment was part of a nationwide ransomware attack on higher education institutions that, in one case, lead the governor of Louisiana to declare a state of emergency, according to a report given to the State Board of Community Colleges Thursday.

Jim Parker, senior vice president and chief information officer for the North Carolina Community College System (NCCCS), said that the attack on RCC shows vulnerabilities that could be exploited at the other 58 colleges in the system. RCC was not the explicit target of this attack, Parker explained, but was likely one of many more targets from across the country.
The RCC attack was the first time an NCCCS institution had been successfully attacked “in this manner, scale and impact,” Parker said in an email.
Click to expand...

FanJ · Oct 18, 2019

mood said: ↑

Emsisoft releases new decryptor for STOP Djvu ransomware
October 18, 2019
https://blog.emsisoft.com/en/34375/emsisoft-releases-new-decryptor-for-stop-djvu-ransomware/
Note: A decryptor for STOP Puma is also available here
Click to expand...

Some quotes from the Emsisoft blog:

Community collaboration

Efforts to help STOP victims have truly been a community collaboration! The good people at Bleeping Computer, for one, have helped numerous STOP victims by guiding them through the decryption process, supplying offline keys and samples and more.
Click to expand...

Because of the very large number of people affected by STOP, we’re unable to provide one-on-one support for this tool. If you need help using the decryptor, please visit the STOP support topic at Bleeping Computer. The community members will be happy to provide assistance and we offer big, big thanks for their help.
Click to expand...

Big thanks to all the community at Bleeping Computer!

PS: at the moment I don't know whether above decryptor(s) are also already at the site of the No More Ransom project.

guest · Oct 18, 2019

Ransomware attack may be affecting 911, emergency dispatch in Jasper Co.
October 18, 2019
https://www.wtoc.com/2019/10/18/ransomware-attack-may-be-affecting-emergency-dispatch-jasper-co/

Earlier this week it was confirmed Jasper County had a cyber attack on their countywide systems, including email and emergency response systems.
At that time, county officials said 911 and emergency dispatch services were not having any issues as a result of the cyberware attack. Now, that may not be the case.

Three weeks. That was the last time the Hardeeville fire department got a call through their dispatch application that speeds up their response time.

“September 25 was the last time we received a notification from one of our applications,” Hardeeville Fire Chief Steve Camp said.
Without the computer systems, calls and data are being logged by pen and paper and transferred to a spreadsheet. As a result, some calls are not being recorded.

The county has told Hardeeville PD it will take another two weeks to get the system back up and the fire chief hopes they use this time as a lesson.
Click to expand...

guest · Oct 19, 2019

Hamden Town Hall computers hit with malware
October 18, 2019
https://www.nhregister.com/metro/article/Hamden-Town-Hall-computers-hit-with-malware-14545648.php

A computer virus infected some Town Hall computers last week and the town is still recovering from the attack.

Several town offices had their computers taken away, including employees in the town clerk’s office, planning and zoning and the town attorney’s office.
Employees last week got an email containing a computer virus that some people opened, clicking on a link meant to infect their computers, the New Haven Independent reported. The whole Town Hall computer system has been inaccessible since.

The virus infected a few computers directly, but the IT Department told all employees to shut down their computers to prevent the virus from spreading, the Independent reported.

"[...] Essential services, including police, fire and emergency services, as well as tax collection and payroll, are operational during the Town’s response to this security event. We hope to resume normal operations government-wide next week."
Click to expand...

guest · Oct 21, 2019

Hackers hit San Bernardino school district with ransomware attack
October 20, 2019
https://www.pe.com/2019/10/20/hackers-hit-san-bernardino-school-district-with-ransomware-attack/

Hackers infected servers used by the San Bernardino City Unified School District with ransomware, locking faculty and staff out of their e-mails over the weekend and forcing classes to proceed without Wi-Fi and other tech-based tools beginning Monday, Oct. 21.
Officials did not disclose what demands the hackers might have made, but said no taxpayer money had been paid in ransom as of Sunday evening.

The ransomware appears to have only affected servers that house the district’s internal email network, Bardere said.
That system is independent from others that store students’ personal information and school financial data. District officials said those were not compromised. However, it was unclear whether hackers were able to read the emails in the infected network.

“We are working non-stop to correct the problem,” a statement on the district website said.
Click to expand...

guest · Oct 21, 2019

Georgia county’s experience shows perils of ransomware
October 21, 2019
https://www.sanluisobispo.com/news/business/technology/article236479173.html

On the first Saturday in March, computer screens at the 911 dispatch center in this small town went dark.
Staff at the county jail around the same time could no longer open cell doors remotely with electronic controls, and sheriff's deputies lost the use of their laptops to look up license plates.
Jackson County was under a ransomware attack.

"It really crippled us as far as just made it harder for our folks to work and do their jobs," Sheriff Janis Mangum said.
Ransomware attacks have taken out computer systems at law enforcement agencies and local governments around the country in recent years, forcing them to revert to pen and paper for tasks typically done in an instant on computers.

"It was very traumatic, very stressful," she said. "We're not a huge agency, so I can't imagine how it would be for agencies that are so much bigger than we are. It would have to be a triple nightmare for them."
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches