Ransomware and Recent Variants

guest · Dec 17, 2019

City Of Galt Targeted In Ransomware Attack
December 17, 2019
https://sacramento.cbslocal.com/2019/12/17/galt-ransomware-hackers-attack/

A ransomware attack has knocked out several of the city of Galt’s digital communications platforms, say city officials.

In the early hours of December 16, hackers were able to put malware on the City of Galt’s computerized systems in order to take over those systems in exchange for money. The city says it doesn’t know how much the hackers want.
The city’s email server was damaged in the attack, knocking out email communication to and from city accounts. The city’s telephone service was also affected, preventing people from being able to call the city offices. Police emergency 911 phone lines were not affected in the attack.

Galt is just one of several public agencies hit with ransomware over the past few months, the city says.
Click to expand...

guest · Dec 18, 2019

ScreenConnect MSP Software Used to Install Zeppelin Ransomware
December 18, 2019
https://www.bleepingcomputer.com/ne...software-used-to-install-zeppelin-ransomware/

Threat actors are utilizing the ScreenConnect (now called ConnectWise Control) MSP remote management software to compromise a network, steal data, and install the Zeppelin Ransomware on compromised computers.

ConnectWise Control is a remote management software commonly used by MSPs and IT professionals in order to gain access to a remote computer to provide support.
Abusing ConnectWise ScreenConnect
In a new report shared with BleepingComputer, security software firm Morphisec explains how they discovered ScreenConnect being abused by attackers to install the Zeppelin Ransomware and other malware.

"The Zeppelin ransomware was delivered through ScreenConnect, a central web application remote desktop control tool that is designed to allow IT admins to manage remote computers and remotely execute commands on a user’s computer."
Attackers had compromised the network of a large real estate company in the USA and installed the ScreenConnect client on a compromised workstation.
Click to expand...

What makes this particular case interesting is that the attacker deployed the ScreenConnect remote management software themselves.

When we normally cover ransomware attacks that utilize MSP software, it is an MSP that is hacked and the actors using their configured remote management software to infect the MSP's downstream clients.
In this particular case, the threat actors themselves are deploying the ScreenConnect software in order to secure a foothold on the network to further compromise other endpoints on the computer.
Click to expand...

Morphisec: ConnectWise Control Abused Again to Deliver Zeppelin Ransomware

guest · Dec 18, 2019

Prairie insurance and financial brokerage failed to disclose ransomware attack
Andrew Agencies says breach 'dealt with' after hackers list it as victim
December 18, 2019
https://www.cbc.ca/news/technology/andrew-agencies-ransomware-1.5400101?cmp=rss

A Manitoba-based insurance and financial brokerage catering to clients across the Prairies has fallen victim to a ransomware attack that it hasn't publicly disclosed.
Andrew Agencies, based in Virden, Man., appears on a list of targets published online this week by an international cybercriminal gang that claims to have locked down the company's machines and stolen its data.

"Andrew Agencies can confirm that it has recently dealt with a security breach incident involving ransomware," the company's lawyer Dave Schioler said in an email response to questions from CBC News.

Since 2018, Canadian privacy law also requires companies to report to the Office of the Privacy Commissioner (OPC) any breach of personal information that could "pose a real risk of significant harm to individuals."
On Tuesday, an OPC spokesperson said it had not been notified of a ransomware attack at Andrew Agencies.
'Horrified' no disclosure was made
What also worries some industry people, however, is Andrew's reluctance to publicly disclose what happened.
Click to expand...

itman · Dec 18, 2019

mood said: ↑

ScreenConnect MSP Software Used to Install Zeppelin Ransomware
Click to expand...

The hideous part of this attack is the attacker legit installed remote connection management client software is using using TCP port 3460 for communication. So any stateful firewall not monitoring all outbound traffic can be bypassed. Assumed is most if not all AVs are not going to detect the installation. Of note is all cmd.exe and PowerShell activity is initiated and run within the legit ScreenConnect software. Another example that once a network is compromised allowing for external access, anything is possible.

guest · Dec 19, 2019

30 years of ransomware: How one bizarre attack laid the foundations for the malware taking over the world
In December 1989 the world was introduced to the first ever ransomware - and 30 years later ransomware attacks are now at crisis levels
December 19, 2019
https://www.zdnet.com/article/30-ye...ations-for-the-malware-taking-over-the-world/

Ransomware has been one of the most prolific cyber threats facing the world throughout 2019, and it's unlikely to stop being a menace any time soon.
The first instance of what we now know as ransomware was called the AIDS Trojan because of who it was targeting – delegates who'd attended the World Health Organization AIDS conference in Stockholm in 1989.

But after this, it wasn't for another 20 years that ransomware as we know it now first started to emerge; and those first attacks were still simple compared with ransomware today.
A common form of this kind of ransomware was the 'Police Locker' attack, [...]
Click to expand...

Minimalist · Dec 20, 2019

How ransomware spreads: 9 most common infection methods and how to stop them

Cybercriminals are looking for creative new ways to hold your data hostage.

However, while ransomware might be getting more sophisticated, it’s important to remember that it still has to abide by the same rules as regular old malware.
Click to expand...

https://blog.emsisoft.com/en/35083/...ommon-infection-methods-and-how-to-stop-them/

guest · Dec 20, 2019

The Week in Ransomware - December 20th 2019 - Attacks Everywhere
December 20, 2019
https://www.bleepingcomputer.com/ne...omware-december-20th-2019-attacks-everywhere/

This week's ransomware news continues to be dominated by targeted ransomware attacks against hospitals, cities, and businesses and the new tactic of releasing victim's data if they do not pay.

Maze continues to make a name for itself by publicly shaming victim's who do not pay by releasing their data. It was also pretty much confirmed that the City of New Orleans was hit with the Ryuk Ransomware after finding memory dumps linking the ransomware to the city's domain controllers.
Otherwise, we continue to see new variants of existing ransomware and some new RaaS services released. These new RaaS offerings, though, are thought to be scams. [...]
Click to expand...

guest · Dec 23, 2019

FBI Issues Alert For LockerGoga and MegaCortex Ransomware
December 23, 2019
https://www.bleepingcomputer.com/ne...ert-for-lockergoga-and-megacortex-ransomware/

The FBI has issued a warning to private industry recipients to provide information and guidance on the LockerGoga and MegaCortex Ransomware.

In an FBI Flash Alert marked as TLP:Amber and seen by BleepingComputer, the FBI is warning the private industry regarding the two ransomware infections and how they attack a network.

"Since January 2019, LockerGoga ransomware has targeted large corporations and organizations in the United States, United Kingdom, France, Norway, and the Netherlands. The MegaCortex ransomware, first identified in May 2019, exhibits Indicators of Compromise (IOCs), command and control (C2) infrastructure, and targeting similar to LockerGoga."
According to the alert, the actors behind LockerGoga and MegaCortex will gain a foothold on a corporate network using exploits, phishing attacks, SQL injections, and stolen login credentials.
FBI's recommended mitigations
The FBI offers guidance and mitigation advise that business owners should utilize to minimize their risk to the LockerGoga and MegaCortex ransomware.
Click to expand...

guest · Dec 23, 2019

Truckstop.com struck by malware attack
December 23, 2019
https://landline.media/truckstop-com-struck-by-malware-attack/

Truckstop.com was the victim of a malware attack, the company posted on its Facebook page on Monday, Dec. 23.

“Truckstop.com is experiencing system issues caused by malware,” the Facebook post stated. “We have been working around the clock to restore service and will continue to do so until we are fully operational.”
As of Monday morning, the company was still trying to determine whether or not any customer information had been breached.

According to its website, Truckstop.com is the largest neutral freight matching marketplace in North America and “is solving transportation problems from finding quality partners to getting paid quickly.”
The company’s Facebook post said it plans to provide the public more information on the incident later Monday.
Click to expand...

guest · Dec 23, 2019

Sherwood telemarketing company temporarily shuts down, blames cyber attack ransom
December 24, 2019
https://katv.com/news/local/sherwoo...orarily-shuts-down-blames-cyber-attack-ransom

A Sherwood telemarketing agency has unexpectedly closed its doors, leaving over 300 employees without jobs a few days before Christmas.

In a letter to employees, CEO of The Heritage Company, Sandra Franecke saying their servers were attacked by hackers, who demanded a ransom, which they paid to get the "key" to their systems. They operate branches in Sherwood, Jonesboro, and Searcy.
She goes on to say that since then, they haven't been able to get everything up and running, and it has caused losses of hundreds of thousands of dollars. Their hope is for this to be a temporary closure.

KATV reached out to the Federal Bureau of Investigation (FBI), and they cannot confirm or deny a cyber attack investigation with The Heritage Company.
Click to expand...

guest · Dec 24, 2019

mood said: ↑

Prairie insurance and financial brokerage failed to disclose ransomware attack
Andrew Agencies says breach 'dealt with' after hackers list it as victim
December 18, 2019
https://www.cbc.ca/news/technology/andrew-agencies-ransomware-1.5400101?cmp=rss
Click to expand...

Andrew Agencies investigates extensive cyberattack
Incident becomes public following CBC story appearing almost two months after attack
December 23, 2019
https://www.weyburnreview.com/andrew-agencies-investigates-extensive-cyberattack-1.24041305

On Wednesday, CBC News reported that the company was the victim of a ransomware attack which allegedly jeopardized the private information of Andrew Agencies customers. Online news site Bleeping Computer suggested a demand of $1.1 million was made for the return of data taken in the hacking.

On Friday, Andrew Agencies responded with an announcement published on their website outlining that it had been targeted in an attack on its IT system on Oct. 21. The incident included the unauthorized access of the company’s network and the uploading of ransomware software.

“Following a rigorous forensic investigation conducted by leading cyber security forensic experts, we can confirm that we have no evidence that would suggest a privacy breach or that any customer or employee personal information was accessed or apprehended by the attackers,” said the Andrew Agency announcement, which was released Friday, two months after the incident.

“We know that the unknown individual(s) was/were able to access high level technical information related to our computer systems, but we have no evidence that would suggest any personal information was impacted,” Andrew Agencies said, also pointing out that reports of the attackers revealing the first and last names of individuals online were found to be false by their investigation.
Click to expand...

Andrew Agencies: Andrew Agencies Ltd. – December 19, 2019 Re: Ransomware incident

guest · Dec 24, 2019

New York comptroller warns Haverstraw that town's computers are vulnerable to ransomware
December 24, 2019
https://eu.lohud.com/story/news/loc...mptroller-town-haverstraw-malware/2732523001/

A New York State Comptroller audit knocked Haverstraw for lax internet usage and security protocols that could have left the town exposed to malware and even ransomware attacks.

Town Supervisor Howard Phillips said on Monday that the town had technology policies in place, but they had not been formalized by resolution by the Town Board. He said policies are now being reviewed and written, and expects the Town Board to approve them in early 2020.

"This is the town's first time having an IT audit," Phillips said. He welcomed the state comptroller's feedback. "It's a good thing that the state comes in and does this. We want to protect our residents and our taxpayers."
The audit reported that the comptroller's office passed information about "sensitive IT control weaknesses" confidentially to town officials.
Click to expand...

FanJ · Dec 24, 2019

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.

Article in Dutch - 24 Dec 2019
https://nos.nl/artikel/2316120-universiteit-maastricht-kampt-met-ransomware-aanval.html

guest · Dec 24, 2019

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.

Article in Dutch - 24 Dec 2019
https://nos.nl/artikel/2316120-universiteit-maastricht-kampt-met-ransomware-aanval.html
Click to expand...

Computers from Maastricht University hostage to destructive pc software
December 24, 2019
https://ourbitcoinnews.com/computers-from-maastricht-university-hostage-to-malicious-software/

The computer systems at Maastricht University have now been struck by alleged hostage pc software, a spokesperson verifies Wednesday mid-day to NU.nl. The educational institution talks of a “serious” cyber assault. This is a variant using the title Clop, that was very first described in February.

According to Maastricht University, most Windows 10 methods tend to be impacted. It can also be “particularly difficult” to utilize email or struggling to access the community via a VPN link. In inclusion, the web library therefore the pupil portal are inaccessible.

“The bottom line is that if you want to do something, you cannot use anything,” representative Gert van Doorn outlines the scenario. “If you want to use e-mail, you will get a blank screen. If you want to open your files, too.”
The college says it offers taken additional steps to guard clinical along with other information. Van Doorn states that this information is take off through the affected system. “The investigation is still ongoing, but it appears that the attack did not gain access to this data.”
Click to expand...

FanJ · Dec 24, 2019

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.

Article in Dutch - 24 Dec 2019
https://nos.nl/artikel/2316120-universiteit-maastricht-kampt-met-ransomware-aanval.html
Click to expand...

From their website in English:
https://www.maastrichtuniversity.nl/news/cyber-attack-against-um

24 December 2019
Cyber attack against UM
Maastricht University (UM) has been hit by a serious cyber attack. Almost all Windows systems have been affected and it is particularly difficult to use e-mail services. UM is currently working on a solution. Extra security measures have been taken to protect (scientific) data. UM is investigating if the cyber attackers have had access to this data. It is unclear how much time UM needs to find a solution, but it will definitely take a while for the systems to be fully operational again.
Click to expand...

guest · Dec 26, 2019

Ryuk Ransomware Stops Encrypting Linux Folders
December 26, 2019
https://www.bleepingcomputer.com/news/security/ryuk-ransomware-stops-encrypting-linux-folders/

A new version of the Ryuk Ransomware was released that will purposely avoid encrypting folders commonly seen in *NIX operating systems.

After analyzing the v2.exe sample, security researcher Vitali Kremez shared with BleepingComputer an interesting change in the ransomware; it would no longer encrypt folders that are associated with *NIX operating systems.
At first glance, it seems strange that a Windows malware would blacklist *NIX folders when encrypting files.

A Linux/Unix variant of Ryuk does not exist, but Windows 10 does contain a feature called the Windows Subsystem for Linux (WSL) that allows you to install various Linux distributions directly in Windows. These installations utilize folders with the same blacklisted names as listed above.

"They definitely have cases affecting WSL environments, which likely led them to blacklist NIX folders as they similarly do with the Windows ones. It is new to me and might explain why Ryuk and how Ryuk affects NIX machines via WSL," Kremez told BleepingComputer.
Click to expand...

As the goal of most successful ransomware is to encrypt a victim's data, but not affect the functionality of the operating system, this change makes sense
Click to expand...

Minimalist · Dec 26, 2019

Emsisoft releases new decryptor for ChernoLocker ransomware

We just released a new decryption tool for the ChernoLocker ransomware strain. You can download the FREE decryption tool linked below. A detailed guide is also included.
Click to expand...

https://blog.emsisoft.com/en/35191/emsisoft-releases-new-decryptor-for-chernolocker-ransomware/

guest · Dec 26, 2019

mood said: ↑

East Greenwich town computers fall victim to ‘ransomware’ attack
December 8, 2019
https://www.wpri.com/news/local-new...h-town-computers-fall-victim-to-cyber-attack/
Click to expand...

Town continues to recover from cyberattack
December 22, 2019
https://www.ricentral.com/east_gree...cle_4768aa82-2535-11ea-b7a7-1bdc21ed1939.html

The town is still coming to grips with the extent of the damage done by the cyberattack two weeks ago that critically compromised the town’s systems. Though the quick thinking of IT staff and the employment of third-party contractors helped to mitigate the damages and prevent the need to pay a ransom demanded by the attacker to restore service, some operational difficulties still linger, and may take many weeks to fully correct.

“Our immediate response was to hire a private company that we had used in the past, and they were on site the next day and are still providing us support,” Schwager said.
The perpetrator or perpetrators behind the attack are not currently known [...]
Despite the problems of bringing the town’s systems back online and continuing its defense, the town’s essential IT functions are nearly at full capacity again, largely due to the aid rendered by the private company hired by the town.
Click to expand...

guest · Dec 27, 2019

The Epidemic Analysis of Ransomware in November 2019
December 27, 2019
https://blog.360totalsecurity.com/en/the-epidemic-analysis-of-ransomware-in-november-2019/

The percentage of ransomware families this month: the Crysis family accounted for 15.85%, ranking first; the Stop family accounted for 15.18%; the phobos family ranked third with 13.62%. Compared with last month’s data, the Stop family’s share has changed significantly, from 9.52% in October to 15.18% this month.

From the proportion of infected systems: Windows 7, Windows 10, and Windows Server 2008 are still the top three systems this month.
The proportion of desktop systems and server systems in the infected systems in November shows that the main attacked systems this month are still desktop systems. Compared with the statistics in October, there is no significant change overall. [...]
Click to expand...

guest · Dec 27, 2019

U.S. Coast Guard Says Ryuk Ransomware Took Down Maritime Facility
December 27, 2019
https://www.bleepingcomputer.com/ne...-ryuk-ransomware-took-down-maritime-facility/

The U.S. Coast Guard (USCG) published a marine safety alert to inform of a Ryuk Ransomware attack that took down the entire corporate IT network of a Maritime Transportation Security Act (MTSA) regulated facility.
While the incident is still currently being investigated, the USCG says that a phishing email is most likely the point of entry within the MTSA facility's network.

"Once the embedded malicious link in the email was clicked by an employee, the ransomware allowed for a threat actor to access significant enterprise Information Technology (IT) network files, and encrypt them, preventing the facility’s access to critical files," says the USCG.
Operations shut down for over 30 hours
Even though the Marine Safety Information Bulletin (MSIB) doesn't mention the type of facility or its name, it's safe to assume that it must be a port given that the attack's description says that the ransomware managed to infiltrate cargo transfer industrial control systems.

"The virus further burrowed into the industrial control systems that monitor and control cargo transfer and encrypted files critical to process operations," adds the USCG.
Click to expand...

guest · Dec 27, 2019

Ransomware at IT Services Provider Synoptek
December 27, 2019
https://krebsonsecurity.com/2019/12/ransomware-at-it-services-provider-synoptek/

Synoptek, a California business that provides cloud hosting and IT management services to more than a thousand customer nationwide, suffered a ransomware attack this week that has disrupted operations for many of its clients, according to sources. The company has reportedly paid a ransom demand in a bid to restore operations as quickly as possible.

The company has nearly a thousand employees and brought in more than $100 million in revenue in the past year, according to their Web site.
News of the incident first surfaced on Reddit, which lit up on Christmas Eve with posts from people working at companies affected by the outage.

Sources also confirm that both the State of California and the U.S. Department of Homeland Security have been reaching out to state and local entities potentially affected by the attack.
Click to expand...

FanJ · Dec 28, 2019

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.
Click to expand...

The following site has articles both in Dutch and in English.
"UM has been in contact with cybercriminals"
https://www.observantonline.nl/Engl...82/UM-has-been-in-contact-with-cybercriminals

Very little information released
MAASTRICHT. During the night of 23-24 December, Maastricht University was hit by Clop ransomware. About twenty-five people are working every day in two shifts to determine the extent of the cyberattack.
Click to expand...

UM has been in contact with said criminals. But how they made contact, whether they will do so again, whether they’re negotiating a ransom and, if so, how large the payment would be – none of that information is being released, says the spokesperson. “Some news outlets are reporting that we are negotiating. I never used that word.”
Click to expand...

FanJ · Dec 30, 2019

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.
Click to expand...

Article in Dutch by national broadcaster NOS - 30 Dec 2019 :
https://nos.nl/artikel/2316708-door...universiteit-maastricht-snel-weer-online.html

Among other things the article says:
- Experts from Fox-IT (among others) are investigating it.
- The local newspaper "De Limburger" is saying: it had contact with Vitali Kremez in New York and he is saying that probably the Russian group TA505 is behind this. (note by me: whether that will be proven, time will tell (or not)...).

guest · Dec 31, 2019

mood said: ↑

Maze Ransomware Demands $6 Million Ransom From Southwire
December 12, 2019
https://www.bleepingcomputer.com/ne...ware-demands-6-million-ransom-from-southwire/
Click to expand...

Firm being blackmailed by hackers for $6m obtains Irish court injunction
Irish-registered company is allegedly linked to a website publishing confidential data
December 31, 2019
https://www.irishtimes.com/news/cri...r-6m-obtains-irish-court-injunction-1.4128069

An American company that claims it is being blackmailed by hackers seeking $6 million (€5.35 million) on Tuesday secured an emergency High Court injunction aimed at removing confidential information posted about it on the internet.

Southwire Company LLC secured a temporary order against what are believed to be two Polish nationals and an Irish-registered company that are all allegedly linked to a website publishing confidential information about the US firm.
The company does not say the individuals or the corporate entity named in its proceedings are behind or involved with the cyber-attack.
Click to expand...

guest · Dec 31, 2019

mood said: ↑

Truckstop.com struck by malware attack
December 23, 2019
https://landline.media/truckstop-com-struck-by-malware-attack/
Click to expand...

Truckstop.com is back up and running
December 31, 2019
https://landline.media/truckstop-com-is-back-up-and-running/

Truckstop.com says most of its major services are back online following what the load board company is now calling a ransomware attack on Dec. 20. The attack shut down the website and most of the company’s services for several days.

Matt Stubbs, senior manager of public relations and communications for the New Plymouth, Idaho-based company, said that once the attack happened, the company immediately contacted law enforcement and brought in a team of security experts to deal with it. At this point, Stubbs said there is no evidence that any customer information was compromised but the systems are being monitored for irregular activity.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

FanJ Updates Team

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

FanJ Updates Team

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

FanJ Updates Team

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

FanJ Updates Team

guest Guest

guest Guest

Useful Searches