Ransomware and Recent Variants

guest · Jan 2, 2020

Ransomware Attackers Offer Holiday Discounts and Greetings
January 2, 2020
https://www.bleepingcomputer.com/ne...ackers-offer-holiday-discounts-and-greetings/

To celebrate the holidays, ransomware operators are providing discounts or season's greetings to entice victims into paying a ransom demand.
Such is the case with the Sodinokibi Ransomware (REvil) who MalwareHunterTeam noticed had changed their ransom note over the holidays to include a new message wishing the victims a "Merry Christmas and Happy Holidays".

I am not sure this will have much effect on getting a victim to pay, but it does add a psychological impact to those who have to deal with them during the holidays.
Maze offered a holiday discount
The Maze operators took it a step further with their holiday celebrations by offering a discount to victims.
In a message to BleepingComputer, the Maze operators stated that they were offering a 25% discount if victims paid between December 25th and December 31st.

While the holidays have come and gone, if you decide to pay the ransom, make sure to negotiate with the ransomware operators as almost all of them are known to accept lower payments than initially demanded.
Click to expand...

FanJ · Jan 4, 2020

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.
Click to expand...

The Observant is saying today:
https://www.observantonline.nl/Engl...0/Cyberhack-Maastricht-University-pays-ransom

Cyberhack: Maastricht University pays ransom
MAASTRICHT. Maastricht University, which was hit by a cyberattack just before Christmas, paid the ‘ransom’ to the hackers. In doing so, the key was obtained to make systems accessible again. This was reported by well-informed sources at the UM. No official statements are being given.
Click to expand...

The UM spokesman does not want to either confirm or deny the stories about any payment of ransom; the university will not make any announcements as long as the investigation into the hack and its consequences is still ongoing
Click to expand...

guest · Jan 2, 2020

In 2020, ransomware attacks will take aim at public infrastructure
January 2, 2020
https://www.wired.co.uk/article/ransomware-2020

In 2019, an increasing number of government agencies, public and financial institutions and electricity companies – all critical parts of daily life – suffered IT system shutdowns as a result of ransomware attacks.
The actual ransom money paid was higher than $5 billion (£3.7bn).

Cyber-awareness campaigns, some supported by government funds, will fail to contain the epidemic. The simplest phishing email will remain the most common entry point of cybercriminals into an organisation’s IT system.
In 2020, insurers will reconsider their cyber-insurance policies, especially as they first identified this threat two decades ago. They have been unable to develop a sustainable and profitable business model for risk assessment.

In 2020, we will see increased efforts by cyber criminals to prey on the wealth of the western world. Equating cyber-criminals to terrorists will become more popular as the stakes become higher.
It will require mobilising tremendous government resources towards securing critical infrastructures, as well as adopting a dynamic national strategy. In 2020, we will reckon with the power of cyber crime.
Click to expand...

guest · Jan 2, 2020

Ransomware attack shuts down some Michigan schools
January 2, 2020
https://www.cbsnews.com/news/ransomware-attack-shuts-down-richmond-michigan-school-district/

A Michigan school district is the latest entity to fall prey to "ransomware," with hackers seizing control of its computer system and demanding $10,000 in bitcoin to release it.

District officials at Richmond Community Schools said their servers were attacked by ransomware during the holiday break and that the virus affected telephones, copiers and classroom technology.
The district has closed three schools for the week so employees can resolve the problem, which officials believe will be "a very time-consuming process." Student and staff information wasn't compromised, the district said.

Richmond Community Schools Superintendent Brian Walmsley said officials won't pay the ransom.
The district is working to migrate critical data to backup servers, Walmsley said, adding that school should resume as normal on Monday.
Click to expand...

guest · Jan 2, 2020

FBI warns U.S. companies about Maze ransomware, appeals for victim data
January 2, 2020
https://www.cyberscoop.com/fbi-maze-ransomware/

The FBI is warning U.S. companies about a series of recent ransomware attacks in which the perpetrator, sometimes posing as a government agency, steals data and then encrypts it to further extort victims.
In an advisory to the private sector last week, the FBI called for vigilance to combat the so-called Maze ransomware, which the bureau said began hitting U.S. organizations in November.

“From its initial observation, Maze used multiple methods for intrusion, including the creation of malicious look-a-like cryptocurrency sites and malspam campaigns impersonating government agencies and well-known security vendors,” states the advisory obtained by CyberScoop.
Ransomware experts told CyberScoop that the Maze perpetrator’s strong-arming tactics are a sign of things to come.

The willingness to both exfiltrate data and hold it for ransom “completely changes the nature of a ransomware incident-response investigation and how organizations, especially those with reporting requirements, have to view a ransomware attack,” Liska told CyberScoop.
Click to expand...

guest · Jan 3, 2020

mood said: ↑

Potter County Sheriff’s Office continues to recover from ransomware attack
July 16, 2019
https://www.myhighplains.com/news/l...-continues-to-recover-from-ransomware-attack/
Click to expand...

Texas County Anticipates Building Cyberattack Recovery Plan
January 2, 2020
https://www.govtech.com/security/Texas-County-Anticipates-Building-Cyberattack-Recovery-Plan.html

In the aftermath of a ransomware attack earlier this year that had countywide implications, Potter County, Texas, officials said they are anticipating a formalized IT disaster recovery process in 2020 to address such occurrences.

"That will be a formal document that we'll get to work through," Potter County Commissioner - Precinct Two Mercy Murguia said regarding the recovery plan initiative, as well as the development of metrics outlining user concerns, computer issues and other help desk related duties.
Officials acknowledged there was no formal IT discovery process in place when the April virus attack occurred. In August the county hired Andrews & Associates IT Solutions to manage all of its IT services.

Firm personnel previously noted a new firewall has been installed, the encryption process has begun on county IT devices and indicated another layer of protection would soon be introduced in the form of dual authentication, adding a second level of identity verification to an account log-in.
Click to expand...

Minimalist · Jan 3, 2020

Ransomware Attack Topples Telemarketing Firm, Leaving Hundreds Jobless

Days before Christmas, employees found out that The Heritage Company had been hit by a ransomware attack and was “temporarily suspending operations.”
Click to expand...

https://threatpost.com/ransomware-attack-topples-telemarketing-firm/

guest · Jan 3, 2020

Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools
January 3, 2020
https://www.bleepingcomputer.com/ne...ow-kills-windows-10-apps-and-3rd-party-tools/

The Clop Ransomware continues to evolve with a new and integrated process killer that targets some interesting processes belonging to Windows 10 apps, text editors, programming IDEs and languages, and office applications.
Clop now terminates 663 processes
In December 2019 a new Clop variant has been discovered by MalwareHunterTeam and reverse engineered by Vitali Kremez that terminates 663 Windows processes before encrypting files.
This new variant takes it a step further by terminating a total of 663 processes, which include new Windows 10 apps, popular text editors, debuggers, programming languages, terminal programs, and programming IDE software.
A full list of the terminated processes can be found in Kremez's GitHub repository.

By embedding this functionality into the main executable, it further signifies active development by the group.
In addition to the new and large list of targeted processes, this Clop Ransomware variant will also utilize a new .Cl0p extension, rather than the .CIop or .Clop extensions used in previous versions.
Click to expand...

guest · Jan 3, 2020

Alvaka Networks Helps Two Businesses Fight Back From Ransomware
January 3, 2020
https://www.crn.com/news/security/alvaka-networks-helps-two-businesses-fight-back-from-ransomware

Alvaka Networks has been busy this holiday season helping two businesses restore systems and resume normal operations following ransomware attacks.
One of the affected businesses has several thousand systems while the other has a couple hundred, Thordarson said, and neither were previous clients of Alvaka.

Ransomware recovery services represented less than 5 percent of Alvaka’s total revenue last year, Thordarson said, and the engagements typically begin on weekends or holidays with no advanced notice. But Thordarson considers the work to be both a public service as well as a potential entry point into organizations that might not have been familiar with Alvaka previously.

"It's personally rewarding from the professional challenge perspective and from helping people out of a tough spot,” Thordarson said. "It's lucrative work, but it's exhausting on our staff because it's so demanding."
“It becomes very difficult to stick to the morality and ethics of not paying bad guys if you're talking about putting 4,000 people out of work and affecting thousands and thousands of clients.”

The deletion of backups by adversaries during ransomware attacks began roughly a year ago has been the biggest game-changer this space has seen, Thordarson said, and now occurs in roughly 50 percent of cases.
Click to expand...

guest · Jan 3, 2020

The Week in Ransomware - January 3rd 2020 - Busy Holiday Season
January 3, 2020
https://www.bleepingcomputer.com/ne...somware-january-3rd-2020-busy-holiday-season/

Normally ransomware activity slows down over the December break, but this year was an exception with a quite a few interesting, and sad, stories such as FBI alerts being issued, companies being shut down, and organizations being encrypted by a variety of ransomware, and stolen data being released.
[...]
Finally, like any other week, we continue to see new variants of existing ransomware being released with new extensions and improvements to their malware executables and infection procedures.
Click to expand...

guest · Jan 3, 2020

DeathRansom evolves from joke to actual ransomware
January 4, 2020
https://www.zdnet.com/article/deathransom-evolves-from-joke-to-actual-ransomware/

A ransomware strain known as DeathRansom, once considered a joke, is now capable of encrypting files using a solid encryption scheme, cyber-security firm Fortinet reported today.
Making matters worse, the ransomware has been backed by a solid distribution campaign, and has been making regular victims on a daily basis for the past two months.
NEW VERSION RELEASED WITH A SOLID ENCRYPTION SCHEME
However, work on the DeathRansom code continued, and newer versions are now working as actual ransomware.
According to Fortinet, the new DeathRansom strains use a complex combination of "Curve25519 algorithm for the Elliptic Curve Diffie-Hellman (ECDH) key exchange scheme, Salsa20, RSA-2048, AES-256 ECB, and a simple block XOR algorithm to encrypt files." [see image above]
FORTINET TRACKS DOWN THE DEATHRANSOM AUTHOR
But Fortinet's investigation into DeathRansom didn't limit itself to analyzing this new malware's source code. Researchers also went looking for clues about the ransomware's author.
Click to expand...

Past posts on hacking forums reveal that Nedugov, acting under the Scat01 username, had posted reviews for malware strains he was using at the time, and which Fortinet later tracked down and documented in their report -- such as Vidar, Evrial, and SupremeMiner.
In an expansive two-series report published today, Fortinet lists all of Nedugov's online accounts and the obvious mesh of connections between them.

Furthermore, the DeathRansom author also appears to have broken one of the unwritten rules of the underground cybercrime scene by "phishing and scamming of his forum mates."

"That is why nearly all his accounts on underground forums were eventually banned," Fortinet said.
Click to expand...

Fortinet:
The Curious Case of DeathRansom: Part I
DeathRansom Part II: Attribution

guest · Jan 3, 2020

Ransomware attack hits Contra Costa library system
Few details initially available on possible data compromise
January 3, 2020
https://www.eastbaytimes.com/2020/01/03/ransomware-attack-hits-contra-costa-library-system/

The Contra Costa County Library System was working to assess the extent of possible exposure after reports of an apparent hack and ransomware attack, authorities said Friday.

A Facebook post late Friday morning initially said the library system “is experiencing a network outage and services at all 26 branches are impacted. Library materials can be checked out if you bring your library card to the branch.”
Officials with the library system were working to determine what kinds of data had been compromised by the attack.

“Obviously we want to protect all of our residents, and having an illegal break-in to the county’s library system is a serious and criminal matter,” Contra Costa County Supervisor John Gioia said Friday evening.
In its statement, the library said it collects names, addresses, phone numbers, e-mail addresses and birth dates, but does not collect Social Security Administration numbers or store credit-card payment information. It also said stopped collecting driver’s license information last year and removed all of it from customer records.

“The Library has no evidence that any personal patron data has been compromised,” the statement read in part.
Click to expand...

guest · Jan 5, 2020

ISD suffers from malware attack
No ETA on when it will be resolved
January 5, 2020
https://www.issaquahreporter.com/news/isd-suffers-from-malware-attack/

The Issaquah School District suffered a malware attack Dec. 22.

In a district email notice, the school stated all websites and email had been turned off due to the malware attack.
Systems that are hosted off-site were not affected by the attack.
As of Dec. 29, the district and school websites were restored. Email, pay online and other systems, sites and pages are still unavailable.
Click to expand...

guest · Jan 6, 2020

Ransomware Recap: Clop, DeathRansom, and Maze Ransomware
January 6, 2020
https://www.trendmicro.com/vinfo/us...re-recap-clop-deathransom-and-maze-ransomware

As the new year rolls in, new developments in different ransomware strains have emerged.
Clop ransomware has evolved to integrate a process killer that targets Windows 10 apps and various applications. DeathRansom, with initial versions that masqueraded as ransomware, now has the ability to encrypt files. Maze ransomware has been increasingly targeting U.S. companies for stealing and encrypting data, as alerted by the Federal Bureau of Investigation (FBI).
Clop ransomware kills Windows 10 apps, other processes
The latest Clop ransomware variant has been updated and is now capable of terminating a total of 663 Windows processes [...]
DeathRansom ransomware evolves from fake ransomware to actual encrypting ransomware
Initially considered a joke, DeathRansom has now been found capable of encrypting files. [...]
Maze ransomware combines theft and encryption to target US companies, FBI warns
The FBI has released an advisory concerning a spate of Maze ransomware attacks that increasingly focus on U.S. companies, stealing their information then encrypting it for extortion. [...]
Click to expand...

Minimalist · Jan 6, 2020

DeathRansom Campaign Linked to Malware Cornucopia

An ongoing DeathRansom malware campaign has been found by researchers to be part of a larger collection of malicious offensives, all carried out by an actor going by the nickname “scat01.”
Click to expand...

https://threatpost.com/deathransom-campaign-malware-cornucopia/

Minimalist · Jan 6, 2020

The Hidden Cost of Ransomware: Wholesale Password Theft

Organizations in the throes of cleaning up after a ransomware outbreak typically will change passwords for all user accounts that have access to any email systems, servers and desktop workstations within their network. But all too often, ransomware victims fail to grasp that the crooks behind these attacks can and frequently do siphon every single password stored on each infected endpoint. The result of this oversight may offer attackers a way back into the affected organization, access to financial and healthcare accounts, or — worse yet — key tools for attacking the victim’s various business partners and clients.
Click to expand...

https://krebsonsecurity.com/2020/01/the-hidden-cost-of-ransomware-wholesale-password-theft/

guest · Jan 7, 2020

East Bay schools hit with cyber attack during break
Pittsburg campuses forced to go 'back in the day' upon return
January 7, 2020
https://www.eastbaytimes.com/2020/01/07/east-bay-schools-hit-with-cyber-attack-during-break/

A ransomware attack left schools in the Pittsburg Unified School District without email or servers when edcuators returned to work from the winter break Monday.

Students were back in class Tuesday, and repair work continued on the computers. Superintendent Janet Schulze said on a message put on social media that a ransomware attack disabled the network systems in the district during the break.

“We will be teaching and learning like ‘back in the day,’ without laptops and internet,” Schulze wrote on social media Monday night. “Our schools have access to student information and our phones are working.”
“We are continuing to investigate and work with a cyber-security team and experts,” she wrote. “Since the investigation is continuing, complete findings are not available, and it is still too early for us to provide further details.”
All of the district’s schools were back open Tuesday on schedule, and Highlands Elementary also operated as scheduled on Monday.
Click to expand...

guest · Jan 8, 2020

SNAKE Ransomware is The Next Threat Targeting Business Networks
January 8, 2020
https://www.bleepingcomputer.com/ne...-the-next-threat-targeting-business-networks/

Since network administrators didn't already have enough on their plate, they now have to worry about a new ransomware called SNAKE that is targeting their networks and aiming to encrypt all of the devices connected to it.

Based on the analysis performed by Kremez, this ransomware is written in Golang and contains a much high level of obfuscation than is commonly seen with these types of infections.

"The ransomware contains a level of routine obfuscation not previously and typically seen coupled with the targeted approach," Kremez, Head of SentinelLabs, told BleepingComputer in a conversation.
This ransomware is still being analyzed for weaknesses and it is not known if it can be decrypted for free. At this time, though, it looks secure.
Click to expand...

guest · Jan 8, 2020

mood said: ↑

Las Cruces Public Schools computers still offline a week after hacking attack
November 4, 2019
https://kvia.com/news/education/201...rs-still-offline-a-week-after-hacking-attack/
Click to expand...

2 months after ransomware attack, Las Cruces Public Schools still crippled by limited internet access
January 7, 2020
https://kvia.com/news/education/202...ls-still-crippled-by-limited-internet-access/

More than two months after a massive ransomware attack compromised the Las Cruces Public Schools network, a teachers' union president told ABC-7 that educators are forced to work extra hours "at the expense of their well-being."

"It has become very overwhelming for our educators," said Denise Sheehan, the president of the National Education Association in Las Cruces. "Ultimately, teachers need to feel appreciated."
According to an NEA survey shared with ABC-7, 47 percent of teachers reported that they work "multiple hours every week" outside of their contract hours due to complications in district technology.

Sheehan said the union plans to ask the district for compensation for the teachers' efforts to maintain a high quality of learning: using their personal cell phone data, printing at home and working extra hours.
Click to expand...

Minimalist · Jan 8, 2020

WannaCry Was the Top Ransomware Infection in 2019

Believe it or not, but WannaCry keeps making victims all over the world, with a new report revealing that it remained the number one ransomware infection last year.
Click to expand...

https://news.softpedia.com/news/wannacry-was-the-top-ransomware-infection-in-2019-528789.shtml

FanJ · Jan 9, 2020

FanJ said: ↑

Maastricht University (Universiteit Maastricht) hit by Clop-ransomware.
Click to expand...

Article in the Observant - 8 Jan 2020
Eliminating the effects of the cyberattack could take weeks
https://www.observantonline.nl/Engl...e-effects-of-the-cyberattack-could-take-weeks

MAASTRICHT. It could take weeks before all the effects of the cyberattack have been eliminated. But last Monday, education programmes started up again with hardly any problems. On Tuesday, the e-mail system was back online again and the network disks that are so important to researchers, were fully accessible. Sister universities are meanwhile taking additional measures.
Click to expand...

Maastricht University was hit by the so-called Clop virus, ransom software that cybercriminals use to lock down computer systems and only release them after payment of a ransom. The UM also paid the hackers a ransom, as Observant found out after New Year’s Day from well-informed sources. The UM does not want to confirm or deny. But according to experts, the fact that after only two weeks a large portion of the IT systems are working again, indicates that they have indeed paid. The amount involved would be a couple of hundred thousand euro in bitcoins.
Click to expand...

In a few weeks’ time, when all systems are working again, the UM will publish an investigation report.
Click to expand...

Maybe by then we will know whether a ransom was paid or not.

guest · Jan 9, 2020

Bartlett Library Recovers from Ransomware Virus
January 8, 2020
https://www.dailyherald.com/submitted/20200107/bartlett-library-recovers-from-ransomware-virus

The Bartlett Public Library District's computer systems were disabled on Saturday, November 30, 2019 by a ransomware virus.
No one's private information was compromised. The library does not store sensitive information such as credit cards, social security numbers, and/or driver's license numbers.

The library's catalog was restored as of Wednesday, Dec. 4. After that, staff members worked on processing manual checkouts from the previous few days, as well as checking items back into the system.
As of Thursday, Dec. 12, all of the systems are up and functional, including email.
Click to expand...

guest · Jan 10, 2020

Ako Ransomware: Another Day, Another Infection Attacking Businesses
Janaury 10, 2020
https://www.bleepingcomputer.com/ne...r-day-another-infection-attacking-businesses/

Like moths to a flame, new ransomware targeting businesses keep appearing every day as they are enticed by the prospects of million-dollar ransom payments. An example of this is a new ransomware called Ako that is targeting the entire network rather than just individual workstations.

Ako was discovered yesterday when a victim posted in the BleepingComputer support forums about a new ransomware that had encrypted both their Windows 10 desktop and their Windows SBS 2011 server.
According to Kremez, who performed the analysis of the ransomware, Ako shares some similarities to MedusaLocker that has led people to call it MedusaReborn.

"This is the new ransomware-as-a-service offering under development with the version 0.5 that seems to be inspired by the Medusa Locker behavior including its anti-Windows behavior and registry mapped drive disable targeting and isolating specific machines for encryption," Kremez told BleepingComputer.
Click to expand...

The ransomware operators confirmed this by telling BleepingComputer via email that the Ako ransomware is their own program.

"We see news about us. But that is wrong. About MedusaReborn. We have nothing to do with Medusa or anything else. This is our own product - Ako Ransomware, well, this is if you are of course interested."
To make matters worse, when we asked the ransomware operators if they are stealing data before encrypting, they told us "Yes, it's our job."
Click to expand...

guest · Jan 10, 2020

Ransomware attacks airport authority's servers
January 9, 2020
https://www.timesunion.com/business...ack-cripples-airport-authority-s-14963401.php

A crypto virus that attacked the Albany County Airport Authority's computer management provider during the Christmas holiday period ended up infecting the authority's servers as well, encrypting files and demanding a ransom payment.

The attack came to light after Schenectady-based LogicalNet reported its own management services network had been breached. From there, the virus spread to the authority's servers, including its backup servers.

"We have severed our relationship with LogicalNet," he added. LogicalNet did not immediately respond to a request for comment.
The ransom was paid in Bitcoin. The airport authority will seek to recover the $25,000 deductible it paid on its insurance policy from LogicalNet. The airport's insurer reimbursed the authority for the rest of the ransom payment.

The Sodinokibi ransomware implicated in the LogicalNet attack is familiar to investigators. It was used in an attack discovered on New Year's Eve on London-based Travelex, a worldwide foreign exchange services provider.
Click to expand...

guest · Jan 10, 2020

mood said:

#1120: Maze Ransomware Demands $6 Million Ransom From Southwire
#1149: Firm being blackmailed by hackers for $6m obtains Irish court injunction
Click to expand...

Maze Ransomware Publishes 14GB of Stolen Southwire Files
January 10, 2020
https://www.bleepingcomputer.com/ne...are-publishes-14gb-of-stolen-southwire-files/

The Maze Ransomware operators have released an additional 14GB of files that they claim were stolen from one of their victims for not paying a ransomware demand.
"Not in retaliation"
Yesterday, the Maze operators released an additional 14.1GB of stolen files that they claim belong to Southwire on a Russian hacking forum. They further state that they will continue to release 10% of the data every week unless the ransom is paid.

"But now our website is back but not only that. Because of southwire actions, we will now start sharing their private information with you, this only 10% of their information and we will publish the next 10% of the information each week until they agree to negotiate. Use this information in any nefarious ways that you want", the Maze operators stated in their post.
[...] But retaliation doesn't come if they begin negotiate with us."
Southwire now needs to weigh the cost of their data being exposed versus the cost of paying the ransom.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches