Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Aug 23, 2020

Minimalist said: ↑

LiveAuctioneers reports data breach after user records sold online

https://www.bleepingcomputer.com/ne...s-data-breach-after-user-records-sold-online/
Click to expand...

Data has been added to Have I Been Pwned:

LiveAuctioneers – 3,385,862 breached accounts

LiveAuctioneers
In June 2020, the online antiques marketplace LiveAuctioneers suffered a data breach which was subsequently sold online then extensively redistributed in the hacking community. The data contained 3.4 million records including names, email and IP addresses, physical addresses, phones numbers and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by breachbase.pw.

Breach date: 19 June 2020
Date added to HIBP: 22 August 2020
Compromised accounts: 3,385,862
Compromised data: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
Permalink
Click to expand...

guest · Aug 25, 2020

DarkSide Ransomware hits North American real estate developer
August 25, 2020
https://www.bleepingcomputer.com/ne...re-hits-north-american-real-estate-developer/

North American land developer and home builder Brookfield Residential is one of the first victims of the new DarkSide Ransomware.

Brookfield Residential is a U.S. and Canada planned community and single-family home builder with $5.7 billion in assets.
Brookfield Residential is one of DarkSide's earliest victims
DarkSide is an enterprise targeting ransomware that began operating around August 10th, 2020.
As part of their extortion strategy, DarkSide will create an entry for each victim whose data has been stolen on their data leak site. After a certain amount of time has expired, the data leak site will begin publishing the stolen data so that anyone with access to the site can download it.
Click to expand...

When the threat actors added Brookfield Residential to their data leak site, they listed their victim as Brookfield Asset Management (brookfield.com).
Due to the similarity in names, DarkSide listed the wrong owner, and the actual victim is Brookfield Residential.

“We recently identified a data security incident, which involved unauthorized access to a limited subset of files. We immediately alerted appropriate authorities, restored affected systems, and implemented additional security measures,” Brookfield Residential told BleepingComputer.
While it is unknown how much DarkSide was demanding for a ransom, previous victims whose data was stolen had ransom demands of $2 million.
Click to expand...

guest · Aug 25, 2020

Ryuk successor Conti Ransomware releases data leak site
August 25, 2020
https://www.bleepingcomputer.com/ne...sor-conti-ransomware-releases-data-leak-site/

Conti ransomware, the successor of the notorious Ryuk, has released a data leak site as part of their extortion strategy to force victims into paying a ransom.

According to Advanced Intel's Vitali Kremez, since July 2020, Ryuk is no longer being deployed, and in its place, the TrickBot-linked operators, are now deploying the Conti ransomware.
Submissions to ransomware identification site ID Ransomware also show the increased activity of Conti ransomware since June 15th.
Click to expand...

Conti releases a data leak site
When human-operated ransomware operations attack a corporate network, they commonly steal unencrypted data before encrypting the files.

This stolen data is then used as leverage to get a victim to pay the ransom under threat that the files will be released on ransomware data leak sites.
This data leak site currently lists twenty-six victims, with some of the names being large and well-known companies.

Conti ransom notes now include specific language stating that they will publish a victim's data if a ransom is not paid, as shown below.
Click to expand...

Other ransomware operations that steal or have stolen unencrypted files to extort their victims include Ako, Avaddon, Clop, CryLock, DoppelPaymer, Maze, MountLocker, Nemty, Nephilim, Netwalker, Pysa/Mespinoza, Ragnar Locker, REvil, Sekhmet, Snatch, and Snake.
Click to expand...

guest · Aug 26, 2020

More Ransomware Gangs Threaten Victims With Data Leaking
22% of Ransomware Incidents Now Involve Data Exfiltration, Investigators Find
August 25, 2020
https://www.databreachtoday.com/more-ransomware-gangs-threaten-victims-data-leaking-a-14883

Ransomware gangs are increasingly not just claiming that they'll leak stolen data from victims that don't meet their ransom demand, but actually following through.

Criminals remotely gaining access to a victim's network, identifying and stealing sensitive data, and only then crypto-locking systems is becoming increasingly common. Security experts say it's all part of gangs' ongoing drive to experiment with new ways to pressure victims into paying - and that, unfortunately, these innovations are leading to higher profits.
Click to expand...

Speaking at Information Security Media Group's Virtual Cybersecurity Summit: New York last week, attorney Craig Hoffman, who's co-leader for the digital risk advisory and cybersecurity team at BakerHostetler, said that in at least 25% of the ransomware cases his firm has helped investigate, attackers claimed to have not just crypto-locked systems, but also to have exfiltrated data (see: Ransomware Gangs' Ruthlessness Leads to Bigger Profits).

Indeed, ransomware incident response firm Coveware says that of the thousands of cases it investigated in the second quarter of this year, 30% involved attackers threatening to release stolen data. And in 22% of all cases, they had actually exfiltrated data, up from 8.7% in the first quarter.

"The intent is not to profit from the value of the data taken through resale, but to coerce more companies to pay that would have otherwise recovered from their backups."
Click to expand...

guest · Aug 26, 2020

SunCrypt Ransomware sheds light on the Maze ransomware cartel
August 26, 2020
https://www.bleepingcomputer.com/ne...re-sheds-light-on-the-maze-ransomware-cartel/

A ransomware named SunCrypt has joined the 'Maze cartel,' and with their membership, we get insight into how these groups are working together.

In June, we broke the story that the Maze threat actors created a cartel of ransomware operations to share information and techniques to help each other extort their victims.
When first started, this cartel included Maze and LockBit, but soon expanded to include Ragnar Locker.
SunCrypt joins the Maze ransomware cartel
In an email sent to BleepingComputer, the operators of a ransomware named SunCrypt stated that they are a new member of the Maze Ransomware cartel.
Click to expand...

SunCrypt told BleepingComputer that they are an independently run ransomware operation from Maze, but as part of the cartel, they have "two-way communication channels with them,"

"They just can't handle all the available field of operations. Our main specialization is ransomware attacks," - SunCrypt ransomware operators.
Yesterday, GrujaRS was finally able to find a sample of the SunCrypt ransomware so we can get a better glimpse into how the ransomware works.

The SunCrypt Ransomware sample is installed via a heavily obfuscated PowerShell script, shown below.
The ransomware is currently being distributed as a DLL that, when executed, will encrypt a computer's files.
Click to expand...

guest · Aug 27, 2020

mood said: ↑

Avaddon ransomware launches data leak site to extort victims
August 10, 2020
https://www.bleepingcomputer.com/ne...re-launches-data-leak-site-to-extort-victims/
Click to expand...

Avaddon Ransomware Joins Data Exfiltration Trend
August 25, 2020
https://cofense.com/avaddon-ransomware-joins-data-exfiltration-trend/

A new attack pattern indicates that another ransomware family is expanding into data exfiltration. Ransomware traditionally forces victims to send a payment to recover their encrypted data. However, a growing number of ransomware operations is adding pressure using data exfiltration – victims who do not pay the ransom will have their data exposed publicly.

Avaddon caught our attention in June when the Trik botnet started sending it to a broad set of targets, signaling threat actors’ willingness to cast a wider net in search of ransom payments. More recently, security researchers indicated that the operators of Avaddon set up a data leak website to publish stolen data if victims fail to pay the ransom.
Click to expand...

Cofense Intelligence is now seeing a campaign that combines Avaddon with an information stealer, indicating that threat actors are preparing to make use of this new extortion feature. The campaign has successfully evaded secure email gateways (SEGs) and targets several different industries, as discussed in detail below.
With these most recent developments, Avaddon has joined a few other ransomware families in adding data exfiltration to use as leverage for extortion payments.

In conclusion, we predict that the most dangerous part of ransomware to organizations soon will be data exfiltration.
Click to expand...

guest · Aug 27, 2020

The Volkswagen Group Has Been Hit by “Conti” Ransomware
The leaked details include invoices that reveal the customer names, addresses, and products bought
August 27, 2020
https://www.technadu.com/volkswagen-group-hit-conti-ransomware/184319/

According to multiple sources, including French media and Cyble, the Volkswagen Group has fallen victim to the “Conti” ransomware group. The actors stole data in the process and are now publishing them on their dedicated leaks portal. The data includes thousands of invoices that come from workshop service and the sales of spare parts.

In total, there are 8,325 invoices in PDF form, exposing details that could be used in scamming or phishing attacks against the clients. Also, these invoices could help BEC actors targeting VW.
Volkswagen is a German car manufacturer which also happens to be among the most successful in the world based in sales numbers.
Click to expand...

This event places the firm in GDPR trouble, as the leaked invoices contain client names, postal addresses, the products they purchased, etc.
Of course, Conti doesn’t care about the timing or the 304,000 people employed by Volkswagen. They want a piece of that massive $282.9 billion yearly revenue, and they have probably been extorting the company for a while now.

The Volkswagen Group hasn’t made any announcements on the incident. Still, according to Cyble, the part of the firm that has been targeted and compromised is a franchise in Salzkotten, Germany. Thus, the leak comes from authorized workshops in that area.
Click to expand...

guest · Aug 28, 2020

REvil Ransomware Operators Claim Valley Health Systems as New Victim
August 28, 2020
https://hotforsecurity.bitdefender....alley-health-systems-as-new-victim-24020.html

Valley Health Systems have been targeted by REvil ransomware operators, according to Cyble security researchers.

The discovery was made during routine monitoring for data leaks when researchers stumbled upon a post made by the ransomware gang.

“Recently, during the monitoring process of data leaks the Cyble Research Team identified a leak disclosure post in which the REvil ransomware operators claimed to have breached Valley Health Systems,” the researchers said.
The ransomware gang even provided snapshots of exfiltrated data to prove their successful attack.
Click to expand...

Although the healthcare provider released no official statement on the attack, the leaked information clearly suggests a data breach.
Click to expand...

Cyble: REvil Allegedly Targets Another Healthcare Organization

guest · Sep 1, 2020

Nefilim Ransomware Evolving Rapidly: Top Targets at a Glance
August 29, 2020
https://www.ehackingnews.com/2020/08/nefilim-ransomware-evolving-rapidly-top.html

One such newly emerged ransomware that was first identified at the end of February 2020, Nefilim, threatens to release victims’ encrypted data if they are unable to pay the ransom. With a striking code resemblance to that of Nemty 2.5 revenge ransomware, Nefilim is most likely to be distributed via exposed Remote Desktop Protocol, according to Vitali Kremez, an ethical hacker at SentinelLabs.

Since April 2020, Nefilim has targeted multiple organizations around the globe, narrowing down on the regions- South Asia, South America, Oceania, North America, and Western Europe. Going by the count of attacks disclosed publicly, manufacturing comes on top as the most preferential and hence the most targeted industries by the operators of Nefilim ransomware; [...]
Click to expand...

One important thing to notice here is that the ransomware has spared the healthcare and education sector entirely as of now, interestingly, no organization from the two aforementioned sectors has been targeted.

Designed specially to penetrate Windows PCs, Nefilim actively abuses Remote Desktop Protocol and uses it as its primary attack vector to infiltrate organizations. It employs a combination of two distinct algorithms AES-128 and RSA-2048 to encrypt the target’s data that is later leaked on their websites known as Corporate Leaks- when victims’ fail to pay the ransom.
Click to expand...

guest · Sep 1, 2020

NetWalker Ransomware in 1 Hour
August 30, 2020
https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/

The threat actor logged in through RDP, attempted to run a Cobalt Strike Beacon, and then dumped memory using ProcDump and Mimikatz. Next, they RDPed into a Domain Controller, minutes before using PsExec to run the NetWalker ransomware payload on all Domain joined systems. The entire intrusion took ~1 hour. [...]
Lateral Movement
The threat actor RDPed into a Domain Controller (DC) after dumping credentials. Shortly after accessing the DC via RDP they dropped ip.list.txt, P100119.ps1, and PsExec.
The threat actor was now ready to execute it’s objective.
Objectives
The threat actor used PsExec to mount a share on all systems as the Domain Administrator and then execute the ransomware payload using PowerShell.
Timeline [...]
Click to expand...

guest · Sep 2, 2020

Class Action Lawsuit Questions Blackbaud's Hacker Payoff
Company Says It Paid Ransomware Attacker for Promise to Delete Stolen Data
August 31, 2020
https://www.inforisktoday.com/class-action-lawsuit-questions-blackbauds-hacker-payoff-a-14922

Filing a class action lawsuit against a business that has suffered a data breach is a common occurrence.

Can thieves be trusted to honor such promises? That's one question posed by a lawsuit seeking class action status filed against South Carolina-based Blackbaud.
The publicly traded firm, [...] suffered a data exfiltration and ransomware attack in May.

Questions persist about the Blackbaud breach because the company detected the intrusion in May but only notified customers beginning in July.
Click to expand...

The lawsuit also calls out the company's mention of paying attackers as a way to try and safeguard victims. "To believe basically a criminal who's hacked into your system that they have stood by their word and deleted the information, I don't think that cuts it," Lee told WFTS.
Click to expand...

guest · Sep 3, 2020

Cyber threat startup Cygilant hit by ransomware
September 4, 2020
https://techcrunch.com/2020/09/03/cygilant-ransomware/

Cygilant, a threat detection cybersecurity company, has confirmed a ransomware attack.
Christina Lattuca, Cygilant’s chief financial officer, said in a statement that the company was “aware of a ransomware attack impacting a portion of Cygilant’s technology environment.”

Cygilant is believed to be the latest victim of NetWalker, a ransomware-as-a-service group, which lets threat groups rent access to its infrastructure to launch their own attacks, according to Brett Callow, a ransomware expert and threat analyst at security firm Emsisoft .
The hackers typically threaten to publish the victim’s files if the ransom isn’t paid.
Click to expand...

Cygilant did not say if it paid the ransom. But at the time of writing, the dark web listing with Cygilant’s data had disappeared.

“Groups permanently delist companies when they’ve paid or, in some cases, temporarily delist them once they’ve agreed to come to the negotiating table,” said Callow. “NetWalker has temporarily delisted pending negotiations in at least one other case.”
Click to expand...

guest · Sep 4, 2020

SunCrypt Ransomware shuts down North Carolina school district
September 4, 2020
https://www.bleepingcomputer.com/ne...re-shuts-down-north-carolina-school-district/

A school district in North Carolina has suffered a data breach after having unencrypted files stolen during an attack by the SunCrypt Ransomware operators, BleepingComputer has discovered.

The Haywood County School district in North Carolina announced that they had suffered a ransomware attack on August 24th, 2020, but had not stated what ransomware was used.
This attack caused the district to shut down its network and halt remote learning, which had started on August 17th.

"Our delay in restarting remote instruction is the uncertainty about the use of staff computers. We will know more when the forensic work is complete."
Click to expand...

Ransomware attack led to a data breach
After performing an investigation, the Haywood Country School District states that unencrypted data was stolen during the ransomware attack.

"In announcing the ransomware attack on Monday, we wanted everyone to understand a data breach was possible. We have now confirmed a data breach occurred. [...]" the school district announced in a new update this week.
As part of their tactics, the SunCrypt operators will steal unencrypted data before encrypting an organization's devices and threaten to release the data if a ransom is not paid.
Click to expand...

guest · Sep 4, 2020

FBI issues second alert about ProLock ransomware stealing data
September 4, 2020
https://www.bleepingcomputer.com/ne...alert-about-prolock-ransomware-stealing-data/

The FBI issued a second warning this week to alert US companies of ProLock ransomware operators stealing data from compromised networks before encrypting their victims' systems.

The 20200901-001 Private Industry Notification seen by BleepingComputer on September 1st comes after the MI-000125-MW Flash Alert on the same subject issued by the FBI four months ago, on May 4th, 2020.
FBI's previous alert also warned private industry partners that ProLock's decryptor is not working properly and that data will be lost since files over 64MB might be corrupted as part of the decryption process.
Click to expand...

ProLock ransoms can reach almost $700K
The operators behind the human-operated ProLock ransomware have been harvesting and exfiltrating information from their victims' devices before deploying their payloads since March 2020 according to the FBI.

The stolen data is later used by the threat actors as leverage in persuading the victim organizations into paying ransoms ranging between $175,000 to more than $660,000 depending on the size of the compromised network as BleepingComputer found.
Click to expand...

The threat actors were observed archiving the stolen data and uploading to cloud storage platforms including OneDrive, Google Drive, and Mega with the help of the Rclone cloud storage sync command-line tool.
Click to expand...

guest · Sep 6, 2020

Ransomware attack halts Argentinian border crossing for four hours
September 6, 2020
https://www.bleepingcomputer.com/ne...s-argentinian-border-crossing-for-four-hours/

Argentina's official immigration agency, Dirección Nacional de Migraciones, suffered a Netwalker ransomware attack that temporarily halted border crossing into and out of the country.

While ransomware attacks against cities and local agencies have become all too common, this may be a first known attack against a federal agency that has interrupted a country's operations.
According to a criminal complaint published by Argentina's cybercrime agency, Unidad Fiscal Especializada en Ciberdelincuencia, the government first learned of the ransomware attack after receiving numerous tech support calls from checkpoints at approximately 7 AM on August 27th.

"The Comprehensive Migration Capture System (SICaM) that operates in international crossings was particularly affected, which caused delays in entry and exit to the national territory," the National Directorate of Migration (DNM) stated.
Click to expand...

Netwalker demands a $4 million ransom
When the Netwalker performs a ransomware attack, ransom notes will be left on devices that have been encrypted.

From a Netwalker Tor payment page shared with BleepingComputer, we have learned that the ransomware actors initially demanded a $2 million ransom.
After seven days passed, the ransom increased to $4 million, or approximately 355 bitcoins, as shown below in the image of Dirección Nacional de Migraciones's ransom page.
Click to expand...

This Tor site also includes a 'Stolen Data' page that displays a screenshot of data stolen from "Migraciones Argentina" during this attack.
Click to expand...

guest · Sep 7, 2020

Chilean bank BancoEstado hit by REVil ransomware
September 7, 2020
https://securityaffairs.co/wordpress/108014/cyber-crime/bancoestado-ransomware.html

Chilean bank BancoEstado, one of the country’s biggest banks, was hit with a ransomware attack that forced its branches to remain closed since September 7.
The ransomware encrypted most of the company servers and workstations.

The bank disclosed the attack on Sunday via Twitter and decided to keep branches closed to investigate the incident and recover its systems.

Our branches will not be operational and will remain closed today,” reads the statement published on Twitter.
Click to expand...

According to ZDNet that cited a source close to the investigation, the Chilean bank was attacked by the REvil ransomware operators, but at the time of writing the BancoEstado’s data have yet to be published on the gang’s leak site.

“Investigators believe that on the night between Friday and Saturday, hackers used this backdoor to access the bank’s network and install ransomware.” reported ZDNet. “Bank employees working weekend shifts discovered the attack when they couldn’t access their work files on Saturday.”
According to the bank, its website, the banking portal, mobile apps, and the ATM network were not impacted thanks to a good design of the BancoEstado’s infrastructure.
Click to expand...

guest · Sep 7, 2020

Newcastle University students' data held to ransom by cyber criminals
Hackers are demanding money from the university in order not to leak student and staff data stolen in the attack
September 7, 2020
https://news.sky.com/story/newcastl...ta-held-to-ransom-by-cyber-criminals-12066081

The criminals have posted stolen files from the university online and are threatening to release more, exposing student and staff data unless they receive a ransom payment, according to a post on Twitter and their darkweb site.

The university says it has alerted the UK's data watchdog, the Information Commissioner's Office, as well as the police.
Brett Callow, a senior researcher at ransomware specialists Emsisoft, told Sky News that the DoppelPaymer criminals use the malware to monetise their access to a victims' network.

In a statement on its website, the university said "it will take several weeks" to address the issues, and that many IT services will not be operating.
Click to expand...

Newcastle University did not respond to Sky News' enquiries about whether it would pay the ransom to protect staff and students' personal data from being leaked online.
In a statement, a spokesperson said: "The investigation into the incident is still at an early stage.
Click to expand...

guest · Sep 8, 2020

Netwalker ransomware hits Pakistan's largest private power utility
September 8, 2020
https://www.bleepingcomputer.com/ne...hits-pakistans-largest-private-power-utility/

K-Electric, the sole electricity provider for Karachi, Pakistan, has suffered a Netwalker ransomware attack that led to the disruption of billing and online services.
K-Electric is Pakistan's largest power supplier, serving 2.5 million customers and employing over 10 thousand people.

Ransomware researcher Ransom Leaks, who told BleepingComputer about this attack, was tipped off by a local Pakistani security company that this attack is impacting K-Electric internal services.
According Rewterz, the cyberattack occurred on the morning of September 7th and is disrupting K-Electric's online billing services and not the supply of power.
Click to expand...

Netwalker is demanding a $3.8 million ransom
After being told about this attack, BleepingComputer has learned from cybersecurity sources who wish to remain anonymous that the Netwalker ransomware attacked K-Electric.

In a Tor payment page seen by BleepingComputer, the ransomware operators demand a $3,850,000 ransom payment. If a ransom is not paid within another seven days, the ransom will increase to $7.7 million.
The Tor payment site also includes a 'Stolen data' page that states the Netwalker operator stole unencrypted files from K-Electric before performing the attack.
Click to expand...

Since the summer of 2019, Netwalker has been actively infecting victims. It wasn't until March 2020, when the threat actors began recruiting skilled hackers and focusing entirely on enterprise networks, that we began to see widespread attacks.
Click to expand...

guest · Sep 9, 2020

mood said: ↑

SeaChange video platform allegedly hit by Sodinokibi ransomware
April 23, 2020
https://www.bleepingcomputer.com/ne...tform-allegedly-hit-by-sodinokibi-ransomware/
Click to expand...

Leading US video delivery provider confirms ransomware attack
September 9, 2020
https://www.bleepingcomputer.com/ne...delivery-provider-confirms-ransomware-attack/

SeaChange International, a US-based leading supplier of video delivery software solutions, has confirmed a ransomware attack that disrupted its operations during the first quarter of 2020.
April ransomware attack now confirmed
BleepingComputer learned of the attack on SeaChange's servers during April 2020 when a ransomware gang posted screenshots of files they claimed to have stolen from the company's servers.
Among those screenshots, we found a cover letter with a Pentagon video-on-demand service proposal.

When BleepingComputer reached out to the US Department of Defense (DoD) to ask if they were aware of a SeaChange breach, the DoD declined to comment saying that it doesn't share info on potential network intrusions or related investigations.

"In accordance with policy, we will have no information to provide on possible network intrusions or investigations into possible network intrusions in either DOD or contractor networks," Department of Defense spokesman Lt. Col. Robert Carver told BleepingComputer.
Click to expand...

However, today, SeaChange finally confirmed the ransomware attack in a 10-Q quarterly report filed with the US Securities and Exchange Commission (SEC).

"In the first quarter of fiscal 2021 [sic], we experienced a ransomware attack on our information technology system," the company reported.
As BleepingComputer previously reported, the SeaChange ransomware attack acknowledged by the company today was claimed at the time by the REvil (aka Sodinokibi) ransomware group.
Click to expand...

guest · Sep 10, 2020

Distribution management firm DXP hit by Windows REvil ransomware
September 10, 2020
https://www.itwire.com/security/dis...firm-dxp-hit-by-windows-revil-ransomware.html

iTWire contacted the company on Wednesday and received an acknowledgement that the inquiry, submitted through an online form on its website, had been received. There has been no reply.
DXP had annual revenue of US$1.27 billion (A$1.75 billion) in 2019, according to the MarketWatch website, with gross profit coming in at US$347.22 million. Its corporate office is in Houston, Texas.

The people behind REvil, which is also known as Sodinokibi, make a ransom demand and then wait to hear from the victim. If the ransom is not paid, then some of the data that has been pilfered during the attack is published.
If a REvil victim is not persuaded by this, then more data is made public.
Click to expand...

REvil is about the most widely used ransomware and is used by a variety of actors in different countries as can be seen from these links: 1, 2, 3, 4, 5, 6, 7, and 8.
Click to expand...

guest · Sep 10, 2020

Equinix data center giant hit by Netwalker Ransomware, $4.5M ransom
September 10, 2020
https://www.bleepingcomputer.com/ne...giant-hit-by-netwalker-ransomware-45m-ransom/

Data center and colocation giant Equinix has been hit with a Netwalker ransomware attack where threat actors are demanding $4.5 million for a decryptor and to prevent the release of stolen data.

Equinix is a massive data center and colocation provider with over 50 locations worldwide. Customers use these data centers to colocate their equipment or to interconnect with other ISPs and network providers.
The attack on Equinix
Early this week, a source shared a Netwalker ransom note with BleepingComputer that was allegedly from an attack on Equinix that occurred over the Labor Day holiday weekend.
Unlike most Netwalker ransom notes seen by BleepingComputer, this note has a specific message for the victim that included a link to a screenshot of allegedly stolen data.
Click to expand...

The screenshot, which we redacted below, contain numerous folders whose names indicate they include financial information, payroll, accounting, audits, and data center reports.
The ransom note includes a link to the Netwalker Tor payment site that shows a $4.5 million, or 455 bitcoin, ransom demand. If the payment was not paid after a certain amount of time, the ransom would double to $9 million.
Click to expand...

Equinix: Equinix Statement on Security Incident

hawki · Sep 12, 2020

"MAZE Claims Attack on US School System [Fairfax, VA -- 12th largest U.S. School system]

The threat group MAZE claims to have carried out a ransomware attack on the twelfth-largest school system in the United States.

According to their website mazenews.top, the cyber-criminal gang has successfully targeted Fairfax County Public Schools in Virginia with crypto-ransomware..."

https://www.infosecurity-magazine.com/news/maze-claims-attack-on-us-school/

"Hackers attack Fairfax County school system with ransomware..."

https://wtop.com/fairfax-county/202...airfax-county-school-system-with-ranswomware/

guest · Sep 12, 2020

US staffing firm Artech discloses ransomware attack, data breach
September 11, 2020
https://www.bleepingcomputer.com/ne...tech-discloses-ransomware-attack-data-breach/

Artech Information Systems, one of the largest US IT staffing companies, has disclosed a data breach caused by a ransomware attack that affected some of its systems during early January 2020.
Ransomware deployed three days after initial breach
The ransomware attack was discovered by Artech after finding ransomware on some systems following reports of unusual activity related to one of its employee’s user accounts.

"That same day Artech engaged a leading third-party forensic investigation firm to assess the security of its systems and to confirm the nature and scope of the incident," a data breach notification letter sent to affected individuals explains [1, 2].
"This is a small part of what we have," REvil's operators said at the time. "If there are no movements, we will sell the remaining, more important and interesting commercial and personal data to third parties, including financial details."
Click to expand...

However, an email shared with BleepingComputer by an Artech employee stated that the company had to shut down all systems, but were able to restore critical services and servers from backup data.
BleepingComputer reached out to Artech to find if they were aware of the attack and the ransomware group's claims but our emails were ignored, with no answer received until we published this article.

However, an email shared with BleepingComputer by an Artech employee stated that the company had to shut down all systems, but were able to restore critical services and servers from backup data.
REvil is a ransomware-as-a-service (RaaS) operation that breaches corporate networks via exposed remote desktop services and compromised Managed Service Providers, as well as by using exploits and spam emails.
Click to expand...

CVE-2019-11510 strikes again. Their Pulse Secure VPN (https://t.co/cNrZ4GjwEQ) server went unpatched for months and months.
— Bad Packets (@bad_packets) September 11, 2020
Click to expand...

guest · Sep 12, 2020

US Court Hit by “Conti” Ransomware
Louisiana Supreme Court Compromised by “Conti” Ransomware Actors
September 11, 2020
https://www.cbronline.com/news/conti-ransomware-court

The infrastructure of US criminal court has been hit by ransomware, with court documents published online in what is thought to be the first ransomware attack of its kind.

Hacking group/ransomware strain Conti has claimed the attack on the Fourth District Court of Louisiana, and published apparent proof of the attack on its dark web page this week.
It appears to have published documents obtained from the court relating to defendant pleas, witnesses and jurors.
Click to expand...

The court’s website remains offline. The Louisiana Supreme Court’s website was also down as we published. It was not clear if infrastructure had been pulled offline for precautionary reasons or if the malware had hit there too.

Brett Callow, threat analyst at New Zealand’s Emsisoft, which closely tracks ransomware attacks, told Computer Business Review:

“The group responsible for the attack is Conti, which is likely the same group that created Ryuk. In other words, they’re experienced big game hunters with a long track record of attacks on the public sector.
He added: “This is the first incident that I can recall in which a court’s data has been exfiltrated and published”, noting that it is the 207th ransomware incident hitting a public sector body thus-far in 2020.
Click to expand...

guest · Sep 16, 2020

LockBit ransomware launches data leak site to double-extort victims
September 16, 2020
https://www.bleepingcomputer.com/ne...ches-data-leak-site-to-double-extort-victims/

The LockBit ransomware gang has launched a new data leak site to be used as part of their double extortion strategy to scare victims into paying a ransom.
Lockbit data leak site
According to cybersecurity intelligence firm Kela, the LockBit ransomware operation posted a link yesterday on a Russian-speaking hacker forum to their new data leak site.

The data leak site currently contains two victims; an automation parts manufacturer and a shipping company.
Click to expand...

LockBit had previously launched a leak site but shut it down around the time they joined the 'Maze Cartel,' and started using Maze's site to publish stolen files
With the release of their data leak site, it is unknown if they are breaking away from this 'cartel' or just want a dedicated site under their control.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches