Ransomware and Recent Variants

Minimalist · Feb 27, 2020

How We Enabled Ransomware to Become a Multibillion-Dollar Industry

The US is home to the world's leading technology companies, so why haven't we solved the ransomware problem by now? The answer is simple: We underestimated the challenge of finding and fixing software vulnerabilities used by ransomware. In the process, we created the perfect environment for a pandemic to take hold and thrive.
Click to expand...

https://www.darkreading.com/risk/ho...a-multibillion-dollar-industry/a/d-id/1337101

guest · Feb 27, 2020

Why city and state governments may be unprepared for ransomware attacks
February 27, 2020
https://www.techrepublic.com/articl...nts-may-be-unprepared-for-ransomware-attacks/

Though ransomware incidents against local governments increased in 2019, many agencies are still unprepared for a potential attack, according to a report released Thursday by IBM Security.

For its report "Public Sector Security Research," IBM commissioned The Harris Poll to survey people who work for state or local government agencies in the US. Based on the 690 employees who responded, the survey found that 73% of them are concerned about impending ransomware threats to cities across the country.
Among all respondents, half of them expect ransomware attacks in their community to rise in the next year, 60% can see their own workplace targeted by such a cyberattack, and 16% have already experienced a ramsomware attack.

Despite the lack of readiness, 66% of those surveyed said they feel their employer is prepared or at least somewhat prepared to deal with cyberthreats to their services. Some 74% also feel confident in their own ability to detect and prevent an attack.
Click to expand...

IBM Survey: Only 38% of State and Local Government Employees Trained on Ransomware Prevention

guest · Feb 28, 2020

mood said: ↑

RCMP investigating after Manitoba child welfare agency says it was hit with ransomware cyberattack
November 24, 2019
https://globalnews.ca/news/6211503/manitoba-child-welfare-agency-cyberattack/
Click to expand...

Southern Manitoba child welfare authority back online following ransomware attack
February 28, 2020
https://www.cbc.ca/news/canada/manitoba/sfnnc-cyberattack-update-feb-2020-1.5476083

The child welfare authority responsible for 5,000 First Nations foster children in southern Manitoba has regained access to its internal IT system after a ransomware virus left the system completely unusable for more than six weeks.

"With the exception of some past emails that have not been restored, the system is no longer impacted by the ransomware attack," lawyer Mouna Hanna, who specializes in cyber- and privacy breaches, said in an email.
The ransomware attack, which happened on Nov. 21, left that system completely paralyzed, meaning all employees on the system were unable to use their computers or access emails.

An unnamed forensic security firm headquartered outside Winnipeg has been leading the southern authority's own investigation, its lawyer previously told CBC News.
A spokesperson for the provincial government confirmed it is no longer providing additional help to the southern authority now that the computer system is back up and running.
Click to expand...

Minimalist · Feb 28, 2020

Ransomware wipes evidence, lets suspected drug dealers walk free

Six alleged drug criminals will go free thanks to a ransomware attack on a small Florida city, it was revealed this month.
Click to expand...

https://nakedsecurity.sophos.com/20...idence-lets-suspected-drug-dealers-walk-free/

guest · Feb 28, 2020

La Salle County: We're still open for business
County dodges questions on financial exposure, payroll
February 28, 2020
https://www.newstrib.com/2020/02/28/la-salle-county-were-still-open-for-business/a4d2ain/

La Salle County officials Friday morning affirmed workers continue to restore the county's computer network "with its first priority being public safety" after a ransomware attack this week.

“All county offices remain open and are operating in lieu of their limited ability to access certain documents and records,” the statement read. “The Circuit Clerk’s Office and the courts remain fully open and fully functional.
La Salle County may be taking a tight-lipped approach but it appears law enforcement offices have been adversely affected.

Meanwhile, a neighboring county has taken note of what happened to La Salle County and officials are taking steps to ensure no ransomware attack happens there.
Bureau County Administrator Sharon Schallhorn said that in light of the issues facing La Salle, Bureau County is taking steps to ensure all systems are functioning "as they should" in addition to routine service maintenance done on the computer systems.
Click to expand...

Minimalist · Feb 28, 2020

US Railroad Contractor Reports Data Breach After Ransomware Attack

RailWorks Corporation, one of North America’s leading railroad track and transit system providers, disclosed a ransomware attack that led to the exposure of personally identifiable information of current and former employees, their beneficiaries and dependents, as well as that of independent contractors.
Click to expand...

https://www.bleepingcomputer.com/ne...-reports-data-breach-after-ransomware-attack/

guest · Feb 28, 2020

The Week in Ransomware - February 28th 2020 - Data Leaks Everywhere
February 29, 2020
https://www.bleepingcomputer.com/ne...are-february-28th-2020-data-leaks-everywhere/

Over the past two weeks, we continue to see small towns, fire departments, hospitals, and companies being attacked by ransomware.

As more ransomware operators adopt the technique of stealing data and publishing it on data leak sites, organizations face increased pressure to declare data breaches after a ransom attack.
More than ever, organizations need to tighten the security on their network to avoid compromise as ransomware attacks no longer just affect the attacked companies, but also their employees. [...]
Click to expand...

guest · Feb 29, 2020

8% of Maltese internet users have been infected by ransomware
February 29, 2020
https://www.maltatoday.com.mt/busin...ternet_users_have_been_infected_by_ransomware

Nearly 10% of Maltese internet users have been asked for payment to get back control of their device at least once in the past three years – compared to just 1% of respondents in all EU member states.

This emerges from a Eurobarometer survey, which also shows a higher rate of virus and malware exposure amongst the Maltese. While only 16% of respondents in all EU 28 member states had discovered malicious software on their device the percentage raises to 28% in Malta.
Click to expand...

Minimalist · Mar 1, 2020

Sodinokibi Ransomware gang threatens to disclose data from Kenneth Cole fashion firm

Not only Maze ransomware gang, the operators behind Sodinokibi Ransomware allegedly leaked the data of Kenneth Cole Productions.
Click to expand...

https://securityaffairs.co/wordpress/98694/malware/sodinokibi-kenneth-cole-data-breach.html

guest · Mar 1, 2020

Records reveal City of Cartersville paid ransomware attackers $380K
February 29, 2020
http://www.daily-tribune.com/storie...ersville-paid-ransomware-attackers-380k,24425

On May 6, 2019, the City of Cartersville alerted residents that the local government had fallen prey to a ransomware attack. Yet since then, details on the size, scope and severity of the cybersecurity breach have remained scarce.

City officials broke their nearly yearlong silence on the cyberattack, however, in the wake of an Open Records Request filed by The Daily Tribune News.
Newly publicized documents indicate the City of Cartersville did indeed pay the ransomware attackers — to the tune of $380,000 in non-tradable Bitcoins, “with an additional $7,755.65 paid for transaction fees and negotiators.”

“That is an internal service fund, so it’s just a rollover amount every year that we have budgeted in all the departments.”
In total, Brock said about 3 terabytes worth of data was impacted by the ransomware attack. That included what Brock describes as “very intensive operating files,” such as electric department substation drawings.
Click to expand...

guest · Mar 1, 2020

Datto Warns MSP Attacks Are ‘Skyrocketing’
March 1,2020
https://www.crn.com/news/managed-services/datto-warns-msp-attacks-are-skyrocketing-

The MSP market has become the key point of attack for bad actors looking at ways to get inside businesses to access their data and inject ransomware.

The rate of attacks is also growing, from one attack about 18 months ago to five attacks just this week alone, Torres said. "The rate of attacks are skyrocketing," he said.
Torres told solution providers at XChange Sunday that the ways in which attackers are going after MSPs is changing quickly.

"[Attackers] figured out what MSPs do," Torres said. "And they find you have the keys to the kingdom. ... MSPs are increasingly under attack. And [attackers are] doing it with the tools we provide."
Click to expand...

guest · Mar 2, 2020

New PwndLocker Ransomware Targeting U.S. Cities, Enterprises
March 2, 2020
https://www.bleepingcomputer.com/ne...r-ransomware-targeting-us-cities-enterprises/

Driven by the temptation of big ransom payments, a new ransomware called PwndLocker has started targeting the networks of businesses and local governments with ransom demands over $650,000.
This new ransomware began operating in late 2019 and has since encrypted a stream of victims ranging from local cities to organizations.

BleepingComputer has been told that the ransom amounts being demanded by PwndLocker range from $175,000 to over $660,000 depending on the size of the network.
PwndLocker says they encrypted Lasalle County's network
A source recently told BleepingComputer that the ransomware attack against Lasalle County in Illinois was conducted by the operators of the PwndLocker Ransomware.
The PwndLocker Ransomware
In a sample shared with BleepingComputer by MalwareHunterTeam, when executed PwndLocker will attempt to disable a variety of Windows services using the 'net stop' command so that their data can be encrypted.
Click to expand...

Some of the applications whose services are targeted include Veeam, Microsoft SQL Server, MySQL, Exchange, Acronis, Zoolz, Backup Exec, Oracle, Internet Information Server (IIS), and security software such as Kaspersky, Malwarebytes, Sophos, and McAfee.
The ransomware will also target various processes and terminate them if detected

It is not known at this time if there are any weaknesses in the encryption algorithm.
Click to expand...

guest · Mar 2, 2020

Legal services giant Epiq Global offline after ransomware attack
March 3, 2020
https://techcrunch.com/2020/03/02/epiq-global-ransomware/

Legal services giant Epiq Global has been hit by a ransomware attack.

The law firm, which provides legal counsel and administration that counts banks, credit giants, and governments as customers, confirmed the attack hit on February 29.

“As part of our comprehensive response plan, we immediately took our systems offline globally to contain the threat and began working with a third-party forensic firm to conduct an independent investigation,” a company statement read. “
A source with knowledge of the incident but who was not authorized to speak to the media said the ransomware hit the organization’s entire fleet of computers across its 80 global offices.

Many of the computers were running old versions of Windows, the source said. “Nothing is up to date,” the source said.
It’s not immediately clear which kind of ransomware was used in the attack, but Epiq Global said in its statement that there was “no evidence” that data was stolen.
Click to expand...

Epiq spokesperson Catherine Ostheimer declined to disclose the details of the ransomware, nor did she provide a percentage of the data or computers impacted by the attack. Ostheimer also declined to confirm the contents of the email obtained by TechCrunch.
Click to expand...

guest · Mar 3, 2020

Casinos in Las Vegas Hit by Suspected Ransomware Attack
March 3, 2020
https://www.cbronline.com/news/casino-ransomware-attack

Slot machines in two Las Vegas casinos were out of action for almost a week in an incident that bears all the hallmarks of a ransomware attack.
Investigations are currently underway by the Nevada State Game Control Board, which told us it is “actively monitoring the situation”.

Four Queens Hotel and Casino and Binion’s Casino in downtown Las Vegas are open for business but for several days were only able to trade in cash, while startling videos of rows of crippled slot machines on empty casino floors swept across Twitter.
Both casinos are owned by the company TLC Casino Enterprises, Inc, which did not respond to multiple requests for comment.

Gaming forum posters said that the outages had continued early this week.
Click to expand...

guest · Mar 4, 2020

District of Squamish hit by ransomware again
March 4, 2020
https://vancouversun.com/technology...ware/wcm/c949cea0-cd5d-4e42-8f35-eae1f5503e34

The municipality of about 20,000 at the north end of Howe Sound said Tuesday the attack was discovered Feb. 27, resulting in many IT systems being closed shut.

Most were brought back “with minimal data loss,” the district said in a news release.
However, as of Tuesday the recreation booking engine Squamishlive was still offline. The municipality was trying to bring that system back online before Wednesday, when spring program registration is scheduled to open.

The district government was also hit by ransomware in May, 2019. According to the district’s latest statement, over the past several months the district has been improving network security and building up network threat protection as a result of that attack.

“The district is now fast-tracking a move to cloud-based server hosting with virus protection and backups built-in.”
Click to expand...

guest · Mar 4, 2020

Spartanburg School District 1 hit with ransomware attack
March 3, 2020
https://www.goupstate.com/news/20200303/spartanburg-school-district-1-hit-with-ransomware-attack

Officials of a Spartanburg County school district didn’t think it was necessary to notify parents when a cyber-attack shut down computer systems for three days last week.
The ransomware attack hit District 1 schools sometime Wednesday, Feb. 26, shutting off internet connectivity and network access. District spokeswoman Sandra Williams said the IT department immediately began working with the South Carolina Law Enforcement Division and the state’s National Guard Cyber Security Battalion to determine how deep the hack went. That work carried over into the weekend.

By Tuesday, the system was back up and running after it was determined that none of the teacher’s payroll information or personal information regarding students was compromised, Williams said.

"We were very lucky," she said.
As for why parents weren’t immediately notified, Williams said school officials didn’t deem it "necessary."
Click to expand...

guest · Mar 5, 2020

Ryuk ransomware hits Fortune 500 company EMCOR
March 5, 2020
https://www.zdnet.com/article/ryuk-ransomware-hits-fortune-500-company-emcor/

EMCOR Group (NYSE: EME), a US-based Fortune 500 company specialized in engineering and industrial construction services, disclosed last month a ransomware incident that took down some of its IT systems.
The incident took place on February 15 and was identified as an infection with the Ryuk ransomware strain.

Details of the attack and the aftermath are not public, but the message announcing the ransomware infection is still present on the company's website almost three weeks after the attack.
The company said it was restoring services, but did not specify if it paid the ransom demand or if it was restoring from backups.
NO SIGN OF DATA THEFT
EMCOR also said that a current review of the infection did not uncover any signs that "that employee or customer data has been taken in the attack."

EMCOR made this clarification because in recent weeks, several ransomware gangs have also begun stealing data from infected companies and threatening to release said data unless the victim pays the ransom demand.
Click to expand...

guest · Mar 6, 2020

PwndLocker Ransomware Gets Pwned: Decryption Now Available
March 5, 2020
https://www.bleepingcomputer.com/ne...nsomware-gets-pwned-decryption-now-available/

Emsisoft has discovered a way to decrypt files encrypted by the new PwndLocker Ransomware so that victims can recover their files without paying a ransom.

We were the first to report about a relatively new ransomware called PwndLocker that was encrypting organizations and cities around the world and then demanding ransoms ranging from $175,000 to over $660,000 depending on the size of the network.
Flaw found in ransomware
After analyzing the PwndLocker ransomware, Emsisoft's Fabian Wosar was able to spot a weakness in the malware that allows victims to recover their files without paying the ransom.

To receive help with the ransomware, Wosar told BleepingComputer that victims need to send him a copy of the ransomware executable that was used in the attack.
Unfortunately, after deploying the ransomware the attackers are deleting this executable.
Click to expand...

Victims may be able to recover the executable using Shadow Explorer or file recovery tools. When searching for the executable, victims should look in the %Temp%, C:\User folders, and %Appdata% folders.
Once an executable is found, victims can contact Emsisoft to receive help.
Click to expand...

Emsisoft: PwndLocker ransomware decryption now available

We have developed a decryption solution for PwndLocker ransomware. Because each decryptor requires customization before use, we cannot make the tool publicly available for download and affected organization should contact us.
PwndLocker
PwndLocker mainly targets businesses and governments. The amount of the PwndLocker ransom demand is victim-specific and therefore varies from case to case, but can be more than $500,000.

PwndLocker has numerous variants, all of which delete shadow volume copies, limiting victims’ ability to recover.
Click to expand...

guest · Mar 5, 2020

mood said: ↑

Government of Nunavut falls victim to ransomware attack
November 3, 2019
https://globalnews.ca/news/6120812/nunavut-ransomware-attack/
Click to expand...

Nunavut’s government has spent $5M to cope with November’s ransomware attack
March 5, 2020
https://www.arctictoday.com/nunavut...-5m-to-cope-with-novembers-ransomware-attack/

The Government of Nunavut has so far spent just over $5 million to deal with the ransomware attack that knocked out its computers on Nov. 2, says the Department of Community and Government Services.

The department’s minister, Lorne Kusugak, recently told the legislature that the territory is now developing a “state-of-the-art” computer system designed to prevent similar attacks.
But the public will have to wait until next month to learn the details of what took place when someone exposed the GN’s computer network to the malicious software.

In response to a request for more information about the recovery, CGS said in an email that the new computer network is functional, but some applications need more work to be brought online, others are not accessible to everyone and some await upgrades.
Click to expand...

guest · Mar 5, 2020

Defense contractor CPI knocked offline by ransomware attack
March 5, 2020
https://techcrunch.com/2020/03/05/cpi-ransomware-defense-contractor/

A major electronics manufacturer for defense and communications markets was knocked offline after a ransomware attack, TechCrunch has learned.

A source with knowledge of the incident told TechCrunch that the defense contractor paid a ransom of about $500,000 shortly after the incident in mid-January, but that the company was not yet fully operational.
California-based Communications & Power Industries (CPI) makes components for military devices and equipment, like radar, missile seekers and electronic warfare technology.
The company confirmed the ransomware attack.

“We are working with a third-party forensic investigation firm to investigate the incident. The investigation is ongoing,” said CPI spokesperson Amanda Mogin. “We have worked with counsel to notify law enforcement and governmental authorities, as well as customers, in a timely manner.”
Click to expand...

A portion of the defense contractor’s systems — about 150 computers — are still running Windows XP, which stopped receiving security patches in 2014.
But it’s not known what kind of ransomware was used in the attack. CPI’s spokesperson did not answer any of our questions, and declined to comment further beyond the brief statement.
Click to expand...

guest · Mar 5, 2020

Evraz's Regina steel operations shut down due to ransomware attack
Company issued a three-day layoff notice that takes effect Friday
March 5, 2020
https://www.cbc.ca/news/canada/sask...shut-down-ransomware-attack-1.5487017?cmp=rss

Regina's Evraz steel mill operations have been shut down after a ransomware attack.

Sources say Evraz issued a three-day layoff notice — to take effect Friday — and is trying to contain the spread of the computer virus.
The company has not confirmed the extent of the attack.
An employee, speaking under condition of anonymity, told CBC the company informed it's workforce in Regina Thursday that it is trying to contain the virus but doesn't know when or if it can be fixed.
Click to expand...

Minimalist · Mar 5, 2020

Ransomware incidents should be treated as data breaches and immediately disclosed

Over the course of 2020, we’ve seen a sharp increase in the use of data-stealing ransomware, an innovative breed of ransomware that not only encrypts a victim’s data, but also extracts it to the attacker’s server.

The stolen data is primarily used as leverage to encourage victims to pay the ransom. However, there is clear evidence indicating that cybercriminals are also using the data to carry out spear phishing attacks on business partners and customers of the victim company.
Click to expand...

https://blog.emsisoft.com/en/35863/...d-as-data-breaches-and-immediately-disclosed/

Minimalist · Mar 5, 2020

Microsoft Shares Tactics Used in Human-Operated Ransomware Attacks

Microsoft today shared tips on how to defend against human-operated ransomware attacks known to be behind hundreds of millions of dollars in losses following campaigns targeting enterprises and government entities.
Click to expand...

https://www.bleepingcomputer.com/ne...cs-used-in-human-operated-ransomware-attacks/

Krusty · Mar 5, 2020

Wool auctions back online after cyber attack brings down selling system

Wool auctions are back in action after a cyber attack shut down the national selling system last week.
Click to expand...

[...]The ransomware attack on the IT system Talman, which provides system software to a large number of brokers and the majority of buying houses in Australia, last week has been a wake up for the country's $3 billion industry.

More than 75 per cent of the wool industries buyers and brokers across Australia and New Zealand rely on the IT system for their business operations.
Click to expand...

https://www.abc.net.au/news/2020-03-05/wool-auctions-back-online-after-cyber-attack/12029592

guest · Mar 6, 2020

The Week in Ransomware - March 6th 2020 - Breaches Everywhere
March 6, 2020
https://www.bleepingcomputer.com/ne...ansomware-march-6th-2020-breaches-everywhere/

Ransomware continues to target the enterprise and local government in the hopes of a big windfall of bitcoins. In addition new variants of STOP, Dharma, and other families continue to be released.

This week we saw Lasalle County, Illinois and the City of Novi Sad, Serbia getting hit with a new ransomware called PwndLocker. The good news is that Emsisoft was able to figure out a way to decrypt the files without paying a ransom.
Ryuk Ransomware has also been a strong presence this week with attacks against Epiq Global, EMCOR, and others.

Finally, ransomware actors continue to leak data for victims who do not pay a ransom and cause the personal information of employees to be leaked during these attacks.
This is why all ransomware attacks must be considered data breaches!
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Krusty Registered Member

guest Guest

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Krusty Registered Member

guest Guest

Useful Searches