Ransomware and Recent Variants

guest · Nov 28, 2019

Dutch Govt Warns of 3 Ransomware Infecting 1,800 Businesses
November 28, 2019
https://www.bleepingcomputer.com/ne...s-of-3-ransomware-infecting-1-800-businesses/

A confidential report from the National Cyber Security Centre (NCSC) in the Netherlands informs that at least 1,800 companies are affected by ransomware across the world.
The report names three file-encrypting malware pieces responsible for the infections that use the same digital infrastructure and considers them "common forms of ransomware."
Big players impacted
The number of victims given by the NCSC is likely conservative since many ransomware attacks go unreported, with organizations recovering from the incident on their own either by restoring files from untainted backups or by paying the ransom.

At least one entity supplying critical infrastructure (drinking water, internet access, energy) was hit by ransomware. The Dutch Broadcast Foundation (NOS) reports that one such victim is a branch in the Netherlands of a U.S.-based chemical company.
The ransomware trio
The three ransomware strains named by the NCSC are LockerGoga, MegaCortex, and Ryuk. All of them have been involved in attacks against businesses.
Click to expand...

NCSC warns that companies should improve their security posture to avoid cyber incidents. This can be done by covering the basics, which still seems to be a problem.
Click to expand...

guest · Nov 29, 2019

PureLocker: the unusual ransomware that encrypts servers
November 28, 2019
https://www.pandasecurity.com/mediacenter/security/purelocker-ransomware-servers/

PureLocker: a new ransomware with unusual tactics
We have now seen another ransomware variant that is threatening organizations worldwide. PureLocker is a piece of ransomware that is being used in targeted attacks against company servers, and seems to have links with notorious cybercriminal groups.

Choosing to target servers could be a way to try to get higher sums from its victims. Attacks on servers often lead to ransom demands of hundreds of thousands of euros. This is because organizations tend to store their most important data on servers and are therefore more likely to be willing to pay higher sums to recover this critical information.
An exclusive backdoor
The source code of PureLocker offers some clues as to its exclusive nature, such as the fact that it contains strings from the ‘more_eggs’ backdoor malware, which is sold by ‘veteran’ malware service providers. Some of the most notorious cybercriminal groups around at the moment use these tools, including Cobalt Gang and FIN6, and PureLocker seems to share some code with campaigns previously carried out by these groups.
Click to expand...

guest · Dec 2, 2019

mood said: ↑

Major German manufacturer still down a week after getting hit by ransomware
Pilz, a German company making automation tool, was infected with the BitPaymer ransomware on October 13
October 21, 2019
https://www.zdnet.com/article/major...-down-a-week-after-getting-hit-by-ransomware/
Click to expand...

Pilz is recovering from a ‘major’ ransomware attack
December 2, 2019
https://drivesncontrols.com/news/fu...ing_from_a__91major_92_ransomware_attack.html

In a statement issued at the SPS exhibition in Nuremberg last week, the family-owned business said that it has overcome the attack, and re-established production and customer service, adding that it is “emerging from the attack stronger”.

According to reports in the computer media, Pilz was hit by a strain of ransomware known as BitPaymer, which has been responsible for several high-profile attacks since 2017, with targets including Scottish hospitals, the PGA, Arizona Beverages and a French TV station.

“With regard to the attack, we are in the best of hands with the investigating authorities,” says managing partner, Thomas Pilz. “However, we are not allowed to say very much about the incident itself, so as not to jeopardise the ongoing investigations.
“However, we can say this much: no customer or supplier data has been stolen and no viral proliferation of the attack has been identified. That’s good news!”

The company, which employs around 2,400 people, also believes that the current situation provides opportunities to strengthen itself – and not only with regard to its IT.
Pilz says it will use its cyber-attack experience to expand its expertise in the field of safety and security and to share this with its customers.
Click to expand...

Minimalist · Dec 2, 2019

The history of Ransomware: A supervillain 30 years in the making

Unlike other supervillains, Ransomware had no defining life event which set him on a path of evil and criminality. On the contrary, Ransomware was a bad actor from the very moment he was conceived…
Click to expand...

https://blog.emsisoft.com/en/34742/history-of-ransomware-a-supervillain-30-years-in-the-making/

guest · Dec 4, 2019

Ransomware attack hits Sycamore School District 427
District: Mail systems, student information systems not affected
December 4, 2019
https://www.daily-chronicle.com/201...ck-hits-sycamore-school-district-427/apeslaw/

Visitors to the Sycamore School District 427 website Tuesday were greeted with a pop-up message saying the district had been the victim of a ransomware attack.
The message from D-427 Superintendent Kathy Countryman addressed the issue on the district’s website.

“This morning, the District discovered some of our internal technology servers have been the victim of ransomware,” the message states. “District staff is working to determine to what extent any information was compromised.”
According to the message, the ransomware did not affect the district-wide email system, phone system, website, student information systems or building alarm systems. The district-owned Chromebooks and the information stored within the district’s Google Suite for Education were not a part of the incident, either.
Click to expand...

guest · Dec 5, 2019

CyrusOne, one of the major US data center provider, hit by ransomware attack
December 5, 2019
https://securityaffairs.co/wordpress/94750/cyber-crime/cyrusone-ransomware-attack.html

A new ransomware attack made the headlines, systems at CyrusOne, one of the biggest data center providers in the US, were infected by the malware.

The company reported the incident to law enforcement, it hired forensics firms to investigate the attack. At the time the company has not yet disclosed the ransomware attack.

“CyrusOne is currently working with law enforcement and forensics firms to investigate the attack and is also helping customers restore lost data from backups.” reads a post published by ZDNet that first reported the news. “According to a copy of the ransom note obtained by ZDNet, this was a targeted attack against the company’s network.”
CyrusOne owns 45 data centers in Europe, Asia, and the Americas, and has more than 1,000 customers, but the infection impacted only some of them.

It seems that the infection took place on December 4, 2019, when a variant of the REvil (Sodinokibi) ransomware infected the systems at the company.
Click to expand...

guest · Dec 5, 2019

Shakespeare Theatre in Madison hit by ransomware attack, loses seating and patron database
December 5, 2019
https://eu.northjersey.com/story/en...ison-nj-suffers-ransomware-attack/2618147001/

A ransomware attack completely wiped the patron database of The Shakespeare Theatre in Madison, which caused them to cancel Wednesday night's performance of Charles Dickens' "A Christmas Carol," the theater announced.

The ransomware attack — which is a software breach that locks access to a computer system until an amount of money is paid to the attacker — occurred over the weekend, the theater's website said. The theater assured customers that their personal information could not be accessed by the attacker but can't be accessed by the theater either.

"As you can see, this is a triple threat situation for us – we have no idea where anyone is sitting or when they are coming – therefore we have no idea which tickets are available for sale, and we have no information on how to contact any of our patrons at this moment in time," the website said.
The theater described it as an existential crisis but vowed it would not threaten its existence.
Click to expand...

Urgent Emergency Notification

guest · Dec 5, 2019

U.S. Secret Service investigates data hack at Bonny Eagle schools
A piece of ransomeware was installed on a district server last weekend
December 5, 2019
https://www.pressherald.com/2019/12...nvestigates-data-hack-at-bonny-eagle-schools/

The U.S. Secret Service is investigating a data breach that exposed the financial information of MSAD 6 employees.

One of the district’s servers was hacked last week and a piece of ransomware was installed, according to school officials. The breach happened on Nov. 30 and was discovered Dec. 2 when employees returned to work after a long holiday weekend, according to school officials.
Employee information that could have been accessed without authorization includes names, dates of birth, Social Security numbers, direct deposit information (including bank account and routing numbers), dates of hire, mailing addresses and income information.

“At this time, we do not know if any such information was accessed, or if it has been, or is likely to be, misused,” school officials said in a press release.
School officials notified employees of the breach on Dec. 4 after being granted permission by the Secret Service.
Click to expand...

guest · Dec 6, 2019

The Week in Ransomware - December 6th 2019 - 'We have seen better days'
December 6, 2019
https://www.bleepingcomputer.com/ne...e-december-6th-2019-we-have-seen-better-days/

With this article we are bringing you the latest ransomware news that occurred over the past two weeks. The news is a still a little light due to some of us taking vacations, but we should be back up to speed next week.

Over the past two weeks we have seen quite a bit of activity from the Ryuk crew who targeted organizations around the world and asked for large ransoms. We also saw other ransomware target organizations such as school districts, the Shakespeare Theatre of New Jersey, Great Plains Health, a U.S. data center, and a museum.
In addition, a new ransomware called DeathRansom had a surge in victims and we continue to see new variants of Dharma, STOP, and others being released at a rapid pace.

Ransomware is not going away, so make sure you get a working backup plan in place as ransomware is ineffective against working backups. [...]
Click to expand...

guest · Dec 7, 2019

Ransomware at Colorado IT Provider Affects 100+ Dental Offices
December 7, 2019
https://krebsonsecurity.com/2019/12/ransomware-at-colorado-it-provider-affects-100-dental-offices/

A Colorado company that specializes in providing IT services to dental offices suffered a ransomware attack this week that is disrupting operations for more than 100 dentistry practices, KrebsOnSecurity has learned.
Thomas Terronez, CEO of Iowa-based Medix Dental, said he’s heard from several affected practices that the attackers are demanding $700,000 in bitcoin from some of the larger victims to receive a key that can unlock files encrypted by the ransomware.

Multiple sources affected say their IT provider, Englewood, Colo. based Complete Technology Solutions (CTS), was hacked, allowing a potent strain of ransomware known as “Sodinokibi” or “rEvil” to be installed on computers at more than 100 dentistry businesses that rely on the company for a range of services — including network security, data backup and voice-over-IP phone service.

“I would recommend everyone reach out to their insurance provider,” said one dentist based in Denver. “I was told by CTS that I would have to pay the ransom to get my corrupted files back.”
“My experience has been very different,” said dental practitioner based in Las Vegas. “No help from my insurance. Still not working, great loss of income, patients are mad, staff even worse.”
Terronez said the dental industry in general has fairly atrocious security practices, and that relatively few offices are willing to spend what’s needed to fend off sophisticated attackers.
Click to expand...

guest · Dec 8, 2019

Sunapee school stands up to ransomware goons
December 7, 2019
https://www.unionleader.com/news/ed...cle_325cea79-c2a8-5e56-90ed-b474c2f69635.html

The Wi-Fi service got restarted last week at Sunapee Middle High School, eight weeks after a ransomware attack took out the school’s data.

The October attack was discovered first by the district’s technology team when it was determined that all of the data was encrypted, said Superintendent Russell Holden. With a lot of work from the district’s two-man IT team, Sunapee is back up and running after two months, he said.

“We were just 100% as of Monday,” Holden said.
While the ransomware attackers were demanding money from the district to give back its data, Sunapee officials consulted with experts and instead went about freeing the data themselves, Holden said. He did not have exact details on the attackers’ demands, but said the district did not consider giving in to them.
Click to expand...

Holden said many teachers throughout the school use Google Drive to store class data. That meant that when Montore was able to at least restore the hardline internet on the first day, most teachers were able to get back up and running, Holden said.
[...] having data backed up on external hard drives helped recover Sunapee’s data sooner.
Click to expand...

Minimalist · Dec 9, 2019

Caution! Ryuk Ransomware decrypter damages larger files, even if you pay

Ryuk has plagued the public and private sectors alike over the past years, generating hundreds of millions of ransom revenues for the criminals behind it. Usually deployed via an existing malware infection within a target’s network, Ryuk wreaks havoc on any system that can be accessed, encrypting data using a combination of RSA and AES.
Click to expand...

https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/

guest · Dec 9, 2019

East Greenwich town computers fall victim to ‘ransomware’ attack
December 8, 2019
https://www.wpri.com/news/local-new...h-town-computers-fall-victim-to-cyber-attack/

A cyber attack has knocked out some parts of the town computer network in East Greenwich, according to Town Manager Andrew Nota.
It happened at the end of the workday Thursday.

Nota said the town’s IT department immediately severed all outside network contact in order to prevent further exposure to the hackers. He said they did not read the full demand and did not know precisely what the hackers were seeking.
The town has been in touch with a technical support team and is coordinating with its insurer since the incident was discovered. They’ve also alerted the cyber units of the Rhode Island State Police and the Rhode Island National Guard.

Nota expects most of the town systems to be running normally by Monday, with more coming online over the next few days.
Click to expand...

guest · Dec 9, 2019

Bitcoin Ransomware Attack in Argentina Encrypts a Decade's Worth of Government Files
December 9, 2019
https://www.cryptoglobe.com/latest/...ncrypts-a-decade-s-worth-of-government-files/

A bitcoin ransomware attack has recently hit a data center in Argentina that houses local government files, and managed to encrypt a decade’s worth of data that has been started to be decrypted.

According to an interview by the country’s Minister of Science and Technology Alicia Bañuelos with the local news outlet Agencia de Noticias de San Luis, a total of 7,700 GB worth of data were originally encrypted, but so far around 90% of that data has reportedly been recovered.
As reported by The Next Web, the attack occurred on November 25 and the exact size of the demanded BTC ransom isn’t known. Reports suggest it was somewhere between 0.5 and 50 BTC, or between $37,000 and $370,000.
Click to expand...

guest · Dec 9, 2019

Snatch Ransomware Disables Security Tools With Reboot to Safe Mode
December 9, 2019
https://www.bleepingcomputer.com/ne...bles-security-tools-with-reboot-to-safe-mode/

Researchers discovered a new Snatch ransomware strain that will reboot computers it infects into Safe Mode to disable any resident security solutions and immediately starts encrypting files once the system loads.

Encrypting the victim's files is possible because most security tools are automatically disabled when Windows devices boot in Safe Mode as the Sophos Managed Threat Response (MTR) team and SophosLabs researchers found.

"Snatch can run on most common versions of Windows, from 7 through 10, in 32- and 64-bit versions," they add. "The samples we’ve seen are also packed with the open-source packer UPX to obfuscate their contents."
Disabling anti-malware solutions and encrypting devices
To take advantage of anti-malware solutions not loading in Safe Mode, the Snatch ransomware component installs itself as a Windows service dubbed SuperBackupMan capable of running in Safe Mode that can't be stopped or paused, and then force restarts the compromised machine.
Click to expand...

Sophos: Snatch ransomware reboots PCs into Safe Mode to bypass protection

guest · Dec 11, 2019

Zeppelin Ransomware Targets Healthcare and IT Companies
December 11, 2019
https://www.bleepingcomputer.com/ne...nsomware-targets-healthcare-and-it-companies/

A new variant of the VegaLocker/Buran Ransomware called Zeppelin has been spotted infecting U.S. and European companies via targeted installs.

This family first started out as VegaLocker and then was renamed to Buran Ransomware, where it was promoted as Ransomware-as-a-Service (RaaS) in May 2019 on Russian malware and hacker forums. Affiliates who joined the RaaS would earn 75% of the ransom payment, while the Buran operators would earn 25%.
Since then, new variants have been released called VegaLocker, Jamper, and since last month, we now have Zeppelin.
The Zeppelin Ransomware
In a new report from Cylance, researchers have discovered the Zeppelin ransomware being used in targeted attacks against IT and healthcare companies. In at least some of the attacks, Cylance believes that they targeted MSPs in order to further infect customers via management software.

Unfortunately, at this time there has been no weaknesses discovered in the ransomware and there is no way to recover files for free.
Click to expand...

Zeppelin payload builder discovered
When researching this ransomware in late November, security researcher Vitali Kremez discovered a builder for the Zeppelin Ransomware that allow affiliates to build different types of payloads.
Click to expand...

BlackBerry Cylance − ThreatVector: Zeppelin: Russian Ransomware Targets High Profile Users in the U.S. and Europe

guest · Dec 11, 2019

Ransomware Hits Florida PRIDE On Saturday, Systems Still Down
December 11, 2019
https://www.bleepingcomputer.com/ne...florida-pride-on-saturday-systems-still-down/

Prison Rehabilitative Industries and Diversified Enterprises Inc (PRIDE) was hit by a ransomware attack on Saturday, December 7. The nonprofit organization's website and affected systems are still down.
PRIDE is an NPO from Florida that's helping inmates to learn vocational skills and to get certifications for easier reintegration once they get released.
Weekend ransomware attack
The ransomware attack that hit PRIDE's computing systems was observed by employees on Saturday after multiple systems including the NPO's website, payroll records, email, customer and vendor lists, and several other backend operations were taken down or became inaccessible.

PRIDE Chief Administrative Officer Dee Kiminki told Tampa Bay Times who first reported the incident that "certain data files within the PRIDE network have been encrypted and rendered unusable."
Florida Department of Corrections spokesperson Michelle Glady also says that the department doesn't believe that any of the information they had on the PRIDE systems has been compromised.
Click to expand...

guest · Dec 12, 2019

The State of Ransomware in the US: Report and Statistics 2019
December 12, 2019
https://blog.emsisoft.com/en/34822/the-state-of-ransomware-in-the-us-report-and-statistics-2019/

What happened?
In 2019, the U.S. was hit by an unprecedented and unrelenting barrage of ransomware attacks that impacted at least 948 government agencies, educational establishments and healthcare providers at a potential cost in excess of $7.5 billion.
The incidents were not simply expensive inconveniences; the disruption they caused put people’s health, safety and lives at risk.

This report examines the cost and the causes of the incidents, discusses the courses of action that should be taken and breaks down the numbers by sector.
Click to expand...

guest · Dec 12, 2019

Another Ransomware Will Now Publish Victims' Data If Not Paid
December 12, 2019
https://www.bleepingcomputer.com/ne...re-will-now-publish-victims-data-if-not-paid/

The operators of the REvil Ransomware, otherwise known as Sodinokibi, have announced that they will use stolen files and data as leverage to get victims to pay ransoms.

A new tactic by ransomware developers is to release a victim's data if they do not pay the ransom. While we have seen these threats in the past, only recently have Ransomware operators, such as Maze, actually followed through.
In a new post to a Russian malware and hacker forum shared with us by security researcher Damian, the public-facing representative of the REvil ransomware known as UNKN states that a new "division" has been created for large operations.
Ransomware attacks are now data breaches
Now that ransomware operators are releasing victim's data, this will need to change and companies will have to treat these attacks like data breaches.
Click to expand...

guest · Dec 12, 2019

Maze Ransomware Demands $6 Million Ransom From Southwire
December 12, 2019
https://www.bleepingcomputer.com/ne...ware-demands-6-million-ransom-from-southwire/

Maze Ransomware operators claim responsibility for another cyber attack, this time against leading wire and cable manufacturer Southwire Company, LLC (Southwire) from Carrollton, Georgia.
Southwire is one of North America's leading wire and cable makers, "building wire and cable, utility products, metal-clad cable, portable and electronic cord products, OEM wire products and engineered products" per a press release published in January 2019.
$6 million ransom
The ransom demanded is 850 BTC, amounting to approximately $6 million. As customary in the case of Maze Ransomware, the ransom note also says that company data has also been exfiltrated, ready to be published if the ransom is not paid.

In an email conversation with BleepingComputer, the group refuted rumors of a $9 million ransom that started on Reddit and also sent proof that Southwire data was downloaded from their servers.

"We would like to point out that we noticed this article here. Indeed that was our work, but they say the price is 9 millions USD, this is not true," they said.
"We do not know who spreads this rumors, the actual price for their network is 850 BTC which is about 6 million USD. We have attached some proofs of their data to this letter."
Click to expand...

The Southwire ransomware attack
Southwire has been hit by the ransomware attack during early Monday and affected computing on a companywide basis.
The company's IT staff started getting affected systems back online one day later according to an Atlanta Business Chronicle report. Southwire's website is still down at the time this article was published.

"We immediately self-quarantined by shutting down the entire network," Jason Pollard, vice president of Talent Acquisition and Communications for the wire manufacturer told the Chronicle.
Click to expand...

guest · Dec 13, 2019

Louisiana Community College System Hit with Ransomware
December 12, 2019
https://www.govtech.com/security/Louisiana-Community-College-System-Hit-with-Ransomware.html

Going into commencement, Baton Rouge Community College computers were hit with ransomware.
The Louisiana State Police have been called in and the computer servers have been shut down, Kizzy Payton, BRCC’s spokeswoman said Wednesday.

“The Louisiana State Police Cyber Crime Unit investigators responded immediately and collected evidence from the BRCC network, and have recently confirmed a cyberintrusion and ransomware situation,” interim chancellor Willie Smith wrote in a memo released to some campus personnel.
“Presently, the situation is being contained and representatives from the Office of Technology Services are assisting BRCC with network restoration efforts," Smith wrote.
Tech personnel were unsure if BRCC’s computers had been hacked as the state’s system was last month. No ransom note has been found, Payton said.
Click to expand...

Minimalist · Dec 14, 2019

The Week in Ransomware - December 13th 2019 - Data Extortion

This has been a busy week with large scale attacks targeting local governments, new variants released, and another ransomware stating that they will use stolen data as leverage to get victims to pay.

Like we do every week, we saw a sprinkling of new Dharma, STOP, and other variants released, but the big news is with existing ransomware.
Click to expand...

https://www.bleepingcomputer.com/ne...ransomware-december-13th-2019-data-extortion/

guest · Dec 15, 2019

Ransomware vs cities in 2019: 174 and counting
December 16, 2019
https://securitybrief.co.nz/story/ransomware-vs-cities-in-2019-174-and-counting

019 has been the “year of ransomware attacks on municipalities”, according to Kaspersky security experts.

This comes after the company’s researchers observed that at least 174 municipal institutions, with more than 3,000 subset organisations, have been targeted by ransomware during the last year.
This represents a 60% increase at least, from the figure in 2018.
Judging by publicly available information, the ransom amounts varied greatly, reaching up to $5,300,000 and $1,032,460 on average.

The malware that was most often cited as a culprit varies too, yet three families were named as the most notorious, by Kaspersky researchers: Ryuk, Purga and Stop.
Click to expand...

Kaspersky: Story of the year 2019: Cities under ransomware siege

Minimalist · Dec 16, 2019

Ryuk Ransomware Likely Behind New Orleans Cyberattack

Based on files uploaded to the VirusTotal scanning service, the ransomware attack on the City of New Orleans was likely done by the Ryuk Ransomware threat actors.
Click to expand...

https://www.bleepingcomputer.com/ne...omware-likely-behind-new-orleans-cyberattack/

guest · Dec 16, 2019

Walla Walla, Wash., University Disrupted by Cyberattack
The ransomware incident, discovered Monday, crashed online networks and phone lines during fall finals
December 13, 2019
https://www.govtech.com/security/Walla-Walla-Wash-University-Disrupted-by-Cyberattack.html

Walla Walla University officials are investigating a campus-wide cyberattack that crashed online networks and phone lines this fall-finals week.
School officials today referred to the hacking, discovered Monday, as a ransomware incident but did not confirm a monetary ransom was demanded.

WWU’s email system is working once again, but a person answering a general contact phone on the campus said all other office phones have not been restored as of this morning.
On Twitter, one person identifying as Sonia Barreraa posted Tuesday that “apparently” someone hacked the school’s system and had demanded a ransom.

“…obviously our school didn’t pay, so all the servers are crashed, nothing is working which means all my deadlines today will be pushed till tomorrow,” the tweet said.
Messages to staff noted login information had been compromised and passwords were no longer operational.

McVay said they are working to restore university systems, and he expects classes to resume as normal on Jan. 6.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches