Ransomware and Recent Variants

guest · May 18, 2020

Netwalker ransomware actors go fileless to make attacks untraceable
May 18, 2020
https://www.scmagazine.com/home/sec...tors-go-fileless-to-make-attacks-untraceable/

Malicious actors have been spotted using an especially sneaky fileless malware technique — reflective dynamic-link library (DLL) injection — to infect victims with Netwalker ransomware in hopes of making the attacks untraceable while frustrating security analysts.

In a company blog post on Monday, Trend Micro threat analyst Karen Victor writes that instead of compiling the malware and storing it into the disk, the adversaries are writing it in PowerShell and executing it directly into memory.

“[...] This eliminates the need for registering the DLL as a loaded module of a process, and allowing evasion from DLL load monitoring tools,” the Trend Micro blog post explains.
“Ransomware in itself poses a formidable threat for organizations. As a fileless threat, the risk is increased as it can more effectively evade detection and maintain persistence,” the blog post continues.
Click to expand...

Trend Micro: Netwalker Fileless Ransomware Injected via Reflective Loading

Threat actors are continuously creating more sophisticated ways for malware to evade defenses.
Recently, we have witnessed threat actors using this technique to deploy ColdLock ransomware. Now, we have seen the same attack using a filelessly executed Netwalker ransomware.

These types of attacks can affect victims tremendously, and they can be painstakingly difficult to recover from. Employing adequate preventive measures, such as applying best practices, will greatly minimize the risk of infection.
Click to expand...

guest · May 18, 2020

mood said: ↑

Taiwan's CPC suffers malware attack, experiences system outage
April 4, 2020
https://www.taiwannews.com.tw/en/news/3927869
Click to expand...

Taiwan suggests China’s Winnti group is behind ransomware attack on state oil company
May 18, 2020
https://www.cyberscoop.com/cpc-ransomware-winnti-taiwan-china/

Taiwanese authorities have suggested that Chinese hackers were behind a ransomware attack against Taiwan’s state oil company, an aggressive assault on one of the island nation’s strategic assets.

Data left behind in the attack, such as a configuration file and domain name, point to the involvement of a group known as Winnti, Taiwan’s Ministry of Justice said in a statement Friday. Winnti is a broad collection of hackers that cybersecurity researchers have linked with the Chinese government.
CyberScoop could not independently confirm that Winnti was involved in the attack.

The ransomware attack forced CPC to rebuild some of its infrastructure and is part of a spate of recent cyberthreats facing Taiwan.
Click to expand...

guest · May 18, 2020

Cyberattack KOs Vermont Legal Aid’s computer system
May 18, 2020
https://vtdigger.org/2020/05/18/cyberattack-kos-vermont-legal-aids-computer-system/

A ransomware attack shut down Vermont Legal Aid’s computer network system, locking up all the data stored on it.
And it will be several weeks before the organization is back to being “fully operational.”

Eric Avildsen, Vermont Legal Aid executive director, said Monday that the organization has brought in a network security consultant and a preliminary assessment of the damage shows that it does not appear any client or staff data has been compromised.

“My staff, they’ve been working from home under trying conditions trying to help Vermonters and then this happened to them,” Avildsen said.
He said he couldn’t publicly say what exactly the ransomware attack involved or how it occurred, as the matter involves a criminal investigation.

Luckily, he said, the attack did not affect the organization’s email, which is a cloud-based system. That allowed Legal Aid to have a record of the people they represent. “Every case starts with an email,” he said.
Click to expand...

Minimalist · May 21, 2020

Snake ransomware leaks patient data from Fresenius Medical Care

Medical data and personally identifiable information belonging to patients at a Fresenius Medical Care unit are currently available online on a paste website.

Fresenius is a large private hospital operator in Europe and its systems were compromised as part of a massive campaign from Snake ransomware that targeted organizations across all verticals.
Click to expand...

https://www.bleepingcomputer.com/ne...aks-patient-data-from-fresenius-medical-care/

guest · May 21, 2020

New ransomware is spreading that charges $1,300 in Bitcoin
It claims that it has encrypted the victim’s files and that they must pay in Bitcoin to get them unlocked
May 21, 2020
https://decrypt.co/29702/new-ransomware-is-spreading-that-charges-1300-in-bitcoin

Cybersecurity experts at SonicWall have discovered new ransomware, dubbed “Instabot” in the antivirus community, that encrypts users’ files and demands 0.14 Bitcoin ($1,274) to unlock them.

On the bright side, you can get a generous 50% discount if you pay the perpetrators within 72 hours after your computer was infected.

“Don’t worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest (sic) encryption and unique key. The only method of recovering files is to purchase decrypt (sic) tool and unique key for you,” the message in the encrypted directories stated.
After contacting the perpetrators, SonicWall’s experts received an email with details of the ransom.
In its email, the hackers also compiled a step-by-step manual on how to register and buy Bitcoin on LocalBitcoins, recommending the platform as the simplest way.
Click to expand...

guest · May 21, 2020

Emsisoft Decryptor for JavaLocker
May 21, 2020
https://www.emsisoft.com/ransomware-decryption-tools/JavaLocker

JavaLocker encrypts its victim's files using the DES algorithm, and appends the extension ".javalocker".
The ransom note "readmeonnotepad.javaencrypt" contain the following text: [...]
Click to expand...

Download: https://www.emsisoft.com/ransomware-decryption-tools/download/javalocker

guest · May 21, 2020

Ransomware deploys virtual machines to hide itself from antivirus software
The operators of the RagnarLocker ransomware are running Oracle VirtualBox to hide their presence
May 22, 2020
https://www.zdnet.com/article/ranso...hines-to-hide-itself-from-antivirus-software/

The operators of the RagnarLocker ransomware are installing the VirtualBox app and running virtual machines on computers they infect in order to run their ransomware in a "safe" environment, outside the reach of local antivirus software.

This latest trick has been spotted and detailed today by UK cyber-security firm Sophos and shows the creativity and great lengths some ransomware gangs will go to avoid detection while attacking a victim.
Sophos says the group has targeted victims in the past by abusing internet-exposed RDP endpoints and has compromised MSP (managed service provider) tools to breach companies and gain access to their internal networks.
Click to expand...

THE VIRTUAL MACHINE TRICK
Instead of running the ransomware directly on the computer they want to encrypt, the RagnarLocker gang downloads and installs Oracle VirtualBox, a type of software that lets you run virtual machines.
[...] The final phase is to load the ransomware inside the virtual machine (VM) and run it. Because the ransomware runs inside the VM, the antivirus software won't be able to detect the ransomware's malicious process.
Click to expand...

Mark Loman, director of engineering and threat mitigation at Sophos told ZDNet today that this is the first time he's seen a ransomware gang abuse virtual machines during an attack.

"In the last few months, we've seen ransomware evolve in several ways. But, the Ragnar Locker adversaries are taking ransomware to a new level and thinking outside of the box," he added.
Click to expand...

Sophos: Ragnar Locker ransomware deploys virtual machine to dodge security

A new ransomware attack method takes defense evasion to a new level—deploying as a full virtual machine on each targeted device to hide the ransomware from view. In a recently detected attack, Ragnar Locker ransomware was deployed inside an Oracle VirtualBox Windows XP virtual machine. The attack payload was a 122 MB installer with a 282 MB virtual image inside—all to conceal a 49 kB ransomware executable.

Since the vrun.exe ransomware application runs inside the virtual guest machine, its process and behaviors can run unhindered, because they’re out of reach for security software on the physical host machine. The data on disks and drives accessible on the physical machine are attacked by the “legitimate” VboxHeadless.exe process, the VirtualBox virtualization software.
Click to expand...

guest · May 22, 2020

The Week in Ransomware - May 22nd 2020 - Constantly Innovating
May 23, 2020
https://www.bleepingcomputer.com/ne...nsomware-may-22nd-2020-constantly-innovating/

Ransomware operators continue to leak data for their victims and develop new ways to infect victims without being detected by security software.
In addition, we saw an interesting technique used by the Ragnar Lock ransomware, where they encrypt victims using virtual machines to evade security software. [...]
Click to expand...

BoerenkoolMetWorst · May 22, 2020

mood said: ↑

Ransomware deploys virtual machines to hide itself from antivirus software
The operators of the RagnarLocker ransomware are running Oracle VirtualBox to hide their presence
May 22, 2020
https://www.zdnet.com/article/ranso...hines-to-hide-itself-from-antivirus-software/

Sophos: Ragnar Locker ransomware deploys virtual machine to dodge security
Click to expand...

Thinking outside the box by putting it in VirtualBox
Anyway, interesting tactic.

guest · May 26, 2020

New [F]Unicorn ransomware hits Italy via fake COVID-19 infection map
May 26, 2020
https://www.bleepingcomputer.com/ne...e-hits-italy-via-fake-covid-19-infection-map/

A new ransomware threat called [F]Unicorn has been encrypting computers in Italy by tricking victims into downloading a fake contact tracing app that promises to bring real-time updates for COVID-19 infections.

According to CERT-AgID, the password for encrypting the files is sent in clear text to the attacker, so it can be retrieved from the network traffic logs.
Doctor Marc says that [F]Unicorn is the work of a novice attacker with little technical knowledge, who used the code from a previously seen ransomware.
Click to expand...

guest · May 26, 2020

mood said: ↑

Ransomware threat raises National Guard's role in state cybersecurity
August 26, 2019
https://statescoop.com/ransomware-cybersecurity-state-government-national-guard-role/
Click to expand...

National Guard Helps Maryland with Cybersecurity
May 26, 2020
https://www.infosecurity-magazine.com/news/national-guard-helps-maryland-with/

The National Guard has been working to keep Maryland safe from cyber-attacks.

Baltimore, Maryland's largest city, was rocked by a catastrophic ransomware attack last year that prevented government officials from performing even basic tasks like sending an email.
In an interview with Federal Computer Week, Colonel Reid Novotny, Maryland National Guard's joint staff (J6) lead for IT and cyber, said that surviving a major attack did not make Baltimore invulnerable to cyber-criminals.

According to Stewart, the National Guard is supporting the state's efforts to thwart cyber-attackers by performing "routine external assessments of the state's websites and networks to identify issues proactively."
Click to expand...

guest · May 27, 2020

Microsoft warns about attacks with the PonyFinal ransomware
PonyFinal infections have been reported in India, Iran, and the US
May 27, 2020
https://www.zdnet.com/article/microsoft-warns-about-attacks-with-the-ponyfinal-ransomware/

Microsoft's security team has issued an advisory today warning organizations around the globe to deploy protections against a new strain of ransomware that has been in the wild over the past two months.

"PonyFinal is a Java-based ransomware that is deployed in human-operated ransomware attacks," Microsoft said in a series of tweets published today.
The intrusion point is usually an account on a company's systems management server, which the PonyFinal gang breaches using brute-force attacks that guess weak passwords.

The ransomware's encryption scheme is considered secure and there is no known way or free decrypter that can recover encrypted files -- at least, at the time of writing.
Click to expand...

KNOWN VICTIMS IN INDIA, IRAN, AND THE US
According to Michael Gillespie and MalwareHunterTeam, two of the individuals behind the ransomware identification portal ID-Ransomware, the PonyFinal ransomware first emerged earlier this year and has made very few victims -- which confirms its use in targeted attacks against carefully selected targets.

Gillespie, a malware researcher at Emsisoft, says all the users who uploaded samples on the ID-Ransomware website for identification have been located in India, Iran, and the US, in order of prevalence.
Click to expand...

guest · May 29, 2020

Ransomware attack targets Nipissing First Nation
May 29, 2020
https://www.nugget.ca/news/local-news/ransomware-attack-targets-nipissing-first-nation

Nipissing First Nation (NFN) has confirmed it was the victim of a ransomware attack earlier this month that affected the administration’s computers and server.
The First Nation provided an update about the attack in the June issue of its monthly newsletter Enkamgak.

According to the statement, administration discovered the attack May 8.
The attack resulted in the administration server being locked, affecting every department, and communication disruptions that are still being worked on.

“The investigation and remedial work remains ongoing. At this point, there is no evidence that personal or confidential information has been released.”
It is unclear exactly how much, or what type of, information had been accessed or whether Nipissing First Nation ended up paying a ransom to the attacker.
Click to expand...

guest · May 29, 2020

The Week in Ransomware - May 29th 2020 - Quiet before the storm?
May 29, 2020
https://www.bleepingcomputer.com/ne...somware-may-29th-2020-quiet-before-the-storm/

For the most part, this week has been fairly quiet with not a lot of new ransomware released and only a few large-scale ransomware attacks.

The biggest news is the Netwalker attack on Michigan State University and a [F]Unicorn spam campaign targeting italy.
Other than that, it has been thankfully pretty quiet. [...]
Click to expand...

guest · May 31, 2020

mood said: ↑

NTPC website apparently hijacked in what looks like a ransomware attack
April 30, 2020
https://www.cbc.ca/news/canada/north/ntpc-apparent-ransomware-attack-1.5551603
Click to expand...

NTPC bills delayed, website still down nearly a month after cyberattack
Power corporation's billing process impacted after website recently hit
May 28, 2020
https://www.cbc.ca/news/canada/north/ntpc-bills-delayed-website-down-cyber-attack-1.5588409

Customers of the Northwest Territories Power Corporation (NTPC) may be getting their monthly power bill for May much later than expected.

In a newspaper advertisement in the Inuvik Drum Thursday, NTPC said that bills for the month of May won't be sent out for another few weeks and bills for the month of June will be sent out shortly afterwards.
The power corporation has said little about last month's attack including whether the hackers wanted ransom to be paid in exchange for corporation data.
Click to expand...

Prendergast said access to services won't be restored until the corporation is confident it can be done safely.
He said there is no set timeline for the restoration work to be completed.
Click to expand...

guest · Jun 2, 2020

mood said: ↑

N.J. town’s computers target of ransomware attack, mayor says. Town’s website knocked offline
May 14, 2020
https://www.nj.com/somerset/2020/05...mayor-says-towns-website-knocked-offline.html
Click to expand...

Systems returning after computer hack in Bernards Township
June 2, 2020
https://www.newjerseyhills.com/bern...cle_1721a727-058d-573f-871a-b61433d50043.html

Most computer operations have been restored, including the township’s website, after the May 11 “Ransomware attack’’ on municipal computers by unknown hackers.
On Monday, June 1, Mayor James Baldassare Jr. told this newspaper that operations were returning to normal.

“There’s still some things pending – it takes time for the system to reload and get back up to speed,’’ he said. “It’s a slow, methodical process.’’
The mayor noted that the township did not pay out anything to the hackers. Additional information on the investigation is pending.

Zarabara again asked if there was insurance coverage for the hack.
Sean McCarthy, the township’s chief financial officer, replied that the township does have cyber liability coverage “that’s helping with our network event.”
Click to expand...

guest · Jun 2, 2020

Krusty said: ↑

MyBudget blames ransomware hack for system outage affecting thousands of customers

https://www.abc.net.au/news/2020-05...e-for-system-outage-amid-coronavirus/12252316
Click to expand...

MyBudget hackers threaten on dark web to release data stolen during cyberattack
June 2, 2020
https://www.abc.net.au/news/2020-06...ybudget-cyberattack/12313464?section=business

Cybercriminals are threatening to publish data they claim to have stolen from financial management group MyBudget online, an internet security expert has warned.

A digital threat analyst with software company Emsisoft, Brett Callow, said the Mespinoza cybercriminal group recently posted MyBudget's name on its site on the dark web — the first step in an extortion attempt.

"The groups all have slightly different strategies when it comes to naming and shaming victims: some start by simply naming the company while others publish a small amount of the data as proof — a bit like a kidnapper sending a pinkie finger," Mr Callow said.
Click to expand...

MyBudget tight-lipped on investigation
In a statement, MyBudget refused to confirm whether it was negotiating with the group.
It maintained there was still "no credible evidence" that information was stolen or would be misused.

"We can confirm that we believe the group responsible is the same group behind other Pysa/Mespinoza malware incidents," the statement read.
Click to expand...

guest · Jun 3, 2020

Ransomware statistics for 2020: Q1 report
June 3, 2020
https://blog.emsisoft.com/en/36303/ransomware-statistics-for-2020-q1-report/

In Q1 2020, we saw the line between ransomware attack and data breach continue to blur.

However, this quarter has shown us that many ransomware groups are no longer content with simply leaking data; they’re weaponizing it.
Much of Q1 2020 was dominated with news of COVID-19 and we saw cybercriminals respond to the crisis in different ways.

The following statistics are based on data from more than 123,300 submissions to Emsisoft and ID Ransomware between January 1 and March 31, 2020.
Most commonly reported ransomware strains of Q1 2020 [...]
Click to expand...

guest · Jun 3, 2020

Spanish Multinational Launches Free Tool to Decrypt Files Affected by VCryptor Ransomware
Telefonica announced a new tool created by its cybersecurity division to decrypt affected files by VCryptor
June 3, 2020
https://cointelegraph.com/news/span...decrypt-files-affected-by-vcryptor-ransomware

On June 3, Spain-based telecommunications conglomerate, Telefónica, released a free tool to recover data encrypted by the VCryptor ransomware.

The tool, VCrypt Decryptor, was created as part of an international initiative titled “No More Ransomware”. This alliance was established by McAfee, Europol, Politie, and Kaspersky. It is one of several tools that aim to decrypt almost 134 types of ransomware.
The free tool created by ElevenPaths aims to take advantage of a weak point in VCryptor’s encryption password method.
Click to expand...

guest · Jun 4, 2020

New Tycoon ransomware targets both Windows and Linux systems
June 4, 2020
https://www.bleepingcomputer.com/ne...mware-targets-both-windows-and-linux-systems/

A new human-operated ransomware strain is being deployed in highly targeted attacks targeting small to medium size organizations in the software and education industries since at least December 2019.

The ransomware, dubbed Tycoon by security researchers with BlackBerry Threat Intelligence and KPMG, is a multi-platform Java-based malware that can be used to encrypt both Windows and Linux devices.
"The overlap in some of the email addresses, as well as the text of the ransom note and the naming convention used for encrypted files, suggests a connection between Tycoon and Dharma/CrySIS ransomware," the Blackberry/KPMG researchers found.
Systems backdoored and anti-malware disabled

"The ransomware was deployed in a targeted attack against an organization, where the system administrators had been locked out of their systems following an attack on their domain controller and file servers," the researchers discovered when analyzing a ransomware attack that took place in April 2020.
The ransomware uses the Java JIMAGE format to create custom malicious JRE builds executed with the help of a shell script.
Click to expand...

No free decryptor for files encrypted by Tycoon ransomware
Tycoon ransomware encrypts the victims' files using" an AES-256 algorithm in Galois/Counter (GCM) mode3 with a 16-byte long GCM authentication tag, which ensures data integrity."
Click to expand...

Blackberry: Threat Spotlight: Tycoon Ransomware Targets Education and Software Sectors

Tycoon is a multi-platform Java ransomware targeting Windows® and Linux® that has been observed in-the-wild since at least December 2019 [1]. It is deployed in the form of a Trojanized Java Runtime Environment (JRE) and leverages an obscure Java image format to fly under the radar.
Click to expand...

guest · Jun 4, 2020

Emsisoft Decryptor for RedRum
June 4, 2020
https://www.emsisoft.com/ransomware-decryption-tools/redrum

RedRum Ransomware encrypts victim's files using AES256 GCM and RSA-1024, adding the extension ".id-.[].redrum" to files.
The ransom note "decryption.txt" contains the following text: [...]
Click to expand...

Download: https://www.emsisoft.com/ransomware-decryption-tools/download/redrum

Dermot7 · Jun 4, 2020

Requested amounts in ransomware attacks rose nearly 200 percent from 2018 to 2019, averaging $115,123 per attack last year.

A report from incident response, risk management and digital forensics firm Crypsis Group reveals that threat actors across a range of cyberattack types have significantly escalated their tactical approaches, becoming more targeted, conducting victim research and employing techniques that enable them to be more successful and extract higher payouts for their efforts.
Click to expand...

https://betanews.com/2020/06/04/cyber-ransom-demands-up/

guest · Jun 5, 2020

Ongoing eCh0raix ransomware campaign targets QNAP NAS devices
June 5, 2020
https://www.bleepingcomputer.com/ne...ransomware-campaign-targets-qnap-nas-devices/

After remaining relatively quiet over the past few months, the threat actors behind the eCh0raix Ransomware have launched a brand new campaign targeting QNAP storage devices.

The threat actors are gaining access to QNAP devices through known vulnerabilities or by brute-forcing weak passwords used on the device.
Once the attackers gain access, they install the ransomware, which encrypts the files stored on the device and appends the .encrypt extension to the file name.

While a decryptor was released by security expert BloodDolly to decrypt previous versions for free, the ransomware developer has since fixed its code weakness.
Click to expand...

guest · Jun 5, 2020

Kupidon is the latest ransomware targeting your data
June 5, 2020
https://www.bleepingcomputer.com/news/security/kupidon-is-the-latest-ransomware-targeting-your-data/

The latest ransomware that everyone needs to watch out for is called Kupidon, and it targets not only corporate networks, but also home user's personal data.
First spotted by MalwareHunterTeam on May 9th after being uploaded to ID-Ransomware, it quickly increased distribution, and victims started streaming into the ransomware identification site.

A sample of the ransomware has not been discovered at this time, but based on conversations with victims and uploaded files, we can provide general information.
While these ransom amounts are not as high as other ransomware families, they can still be too much for many people to pay.
Click to expand...

Unfortunately, we have not been able to find a sample of the Kupidon Ransomware, so there is no way to analyze it for weaknesses.
Eventually, a sample will be discovered, and if a weakness can be found, we will be sure to let everyone know.
Click to expand...

Minimalist · Jun 6, 2020

The Week in Ransomware - June 5th 2020 - Threat actors team up

It was quite a busy week with lots of new developments, including ransomware operations teaming up, new extortion tactics, and significant cyberattacks revealed.
Click to expand...

https://www.bleepingcomputer.com/ne...nsomware-june-5th-2020-threat-actors-team-up/

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

BoerenkoolMetWorst Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Dermot7 Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

BoerenkoolMetWorst Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Dermot7 Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches