Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Sep 16, 2020

University Hospital New Jersey hit by SunCrypt ransomware, data leaked
September 16, 2020
https://www.bleepingcomputer.com/ne...ersey-hit-by-suncrypt-ransomware-data-leaked/

University Hospital New Jersey (UHNJ) has suffered a massive 48,000 document data breach after a ransomware operation leaked their stolen data.

The hospital runs on a $626 million budget and has over 3,500 employees, 519 licensed beds, and over 172,000 annual outpatient visits.
Sensitive info leaked after a ransomware attack
The SunCrypt ransomware operation has leaked data allegedly stolen from UHNJ in a September ransomware attack.
SunCrypt is a ransomware operation that began its activities in October 2019 but was not very active. Over the past few months, they have become much more active since releasing a dedicated leak site.
Click to expand...

Of the 240 GB of data allegedly stolen from University Hospital New Jersey, the attackers have leaked a 1.7 GB archive containing over 48,000 documents.
Employee infected with TrickBot prior to the attack
A source in the cybersecurity industry has told BleepingComputer that an employee of UHNJ was infected with the TrickBot trojan at the end of August.

While Maze denies any affiliation with SunCrypt, the SunCrypt ransomware operators have told BleepingComputer that they are part of the Maze Cartel.
The SunCrypt operators may have also partnered with TrickBot to provide access to compromised networks, such as the network of UHNJ.
Click to expand...

guest · Sep 17, 2020

mood said: ↑

LockBit ransomware launches data leak site to double-extort victims
September 16, 2020
https://www.bleepingcomputer.com/ne...ches-data-leak-site-to-double-extort-victims/
Click to expand...

“LockBit” Launches Ransomware Blog, Blackmails Two Companies
September 16, 2020
https://geminiadvisory.io/lockbit-launches-ransomware-blog/

On September 14, 2020, on the day that the LockBit blog was created, it posted two data breaches respectively affecting Yaskawa Electric Corporation and Overseas Express Shipping Company.

It is worth noting that cybercriminals do not always immediately divulge the fact that the victim’s database was downloaded. They sometimes only do so after the payment for decryption has been made, which allows the cybercriminals to double dip, first receiving a payment for the decryption key, and then later demanding a second payment for the database.
If victims do not pay up, cybercriminals can threaten the victim to post the database for sale or even for free in the dark web.
Click to expand...

Conclusion
Although data on the two victims has been posted, the success of LockBit’s encryption remains unclear. As was indicated by wexford, it appears that earlier ransomware attacks did not achieve their desired results, and as such, some of the victims may have escaped with no significant damage to the company.
Additionally, the aggressive means by which LockBit threatened their latest victim and the subsequent posting of their database for free could indicate a failed encryption attempt and a desperate attempt to display their resolve and deter other victims from refusing to pay.

Regardless of the successes and failures of LockBit, Gemini Advisory assesses with high confidence that the ransomware threat is likely to be persistent and will continue to threaten a wide range of companies.
Click to expand...

guest · Sep 18, 2020

Ransomware Hacking Groups Post Data from 5 Healthcare Entities
September 17, 2020
https://healthitsecurity.com/news/ransomware-hacking-groups-post-data-from-5-healthcare-entities

The hacking groups behind Pysa, or Mespinoza, SunCrypt, REvil, and NetWalker ransomware variants posted data allegedly stolen from five separate healthcare entities on the dark web for sale, in an effort to force the organizations into paying their ransom demands.

In one of the more prolific recent attacks, the University of California San Fransisco paid NetWalker hackers $1.14 million to decrypt the data and restore access to the impacted servers, after they infected the network of its School of Medicine.
In recent weeks, the blogs of these threat actors have posted “proofs” of data stolen from Assured Imaging, University Hospital New Jersey, National Western Life, The College of Nurses of Ontario, and Nonin Medical, a Minnesota-based designer and manufacturer of noninvasive pulse oximeters, regional oximeters, and capnographs for patient monitoring.
Click to expand...

HealthITSecurity.com reached out to EmsiSoft Threat Analyst Brett Callow, to understand how the healthcare sector can better defend and respond against prevalent ransomware threats. The attacks continue to remain problematic given the disruption they cause to critical services.

“Because so many groups now routinely, these incidents are very often data breaches which expose victim organizations to the possibility of class action lawsuits, regulatory penalties and a myriad of other potential problems,” Callow said
“And, of course, these incidents are bad news for patients too, as it’s typically their medical records and personal information that is exposed and posted online.”

This can be evidenced in the continued increase of the average ransom demand in recent years, as “criminals are more motivated and better resourced than ever before.”
Click to expand...

guest · Sep 22, 2020

Details of 540,000 sports referees taken in failed ransomware attack
ArbiterSports said it paid the hackers to delete the stolen data — a database backup
September 21, 2020
https://www.zdnet.com/article/details-of-540000-sports-referees-taken-in-failed-ransomware-attack/

A company that provides software for sports leagues to manage referees and game officials has disclosed a security incident that impacted around 540,000 of its registered members — consisting of referees, league officials, and school representatives.

ArbiterSports, the official software provider for the NCAA (National Collegiate Athletic Association) and many other leagues, said it fended off a ransomware attack in July this year.
In a data breach notification letter filed with multiple states across the US [1, 2], the company said that despite detecting and blocking the hackers from encrypting its files, the intruders managed to steal a copy of its backups.

This backup contained data from ArbiterGame, ArbiterOne, and ArbiterWorks — three of the web applications used by schools and sports leagues to assign and manage the schedules and training programs of referees and game officials.
Click to expand...

ArbiterSports said that after blocking the attempt to encrypt its local data, the hackers reached out and demanded payment in exchange for deleting the files that they obtained.
The company said it paid the ransom demand and "obtained confirmation that the unauthorized party deleted the files."

However, there is no guarantee that the hackers haven't made a copy of the data before deleting ArbiterSport's data. Sources in the incident response (IR) community have told ZDNet about cases where ransomware gangs did not delete the data.
Click to expand...

guest · Sep 23, 2020

A New Ransomware Group Is Calling Hackers to Join the “DarkSide”
September 23, 2020
https://www.technadu.com/new-ransomware-group-calling-hackers-join-darkside/210012/

A new ransomware as a service (RaaS) group named “DarkSide” has emerged on the dark web, taking its first tentative but otherwise solid steps in August 2020. Digital Shadows has been following the new group’s first operations and confirms that the DarkSide is a fairly typical group of actors adding itself to the rising trend of “ransomware as a corporation.”

What makes DarkSide different is that the group wants to target economically strong entities, they are using custom executables for each target, and they also like to release pro-grade press releases.
In some cases, there have been indications that the DarkSide operators used TeamViewer to access the target computers.

The ransom note is also highly personalized, containing many details about what data has been exfiltrated, a link to the corresponding leak site entry, and what will happen if the ransom demands aren’t met.
Moreover, press releases are further pulling the lever of pressure to the extorted entity, as the data leak is further publicized.
Click to expand...

Although still pretty young, it is estimated that the DarkSide ransomware group has already made about one million USD, although Digital Shadows couldn’t confirm this figure. As for the possibility of affiliations and collaborations, the group follows similar tactics as DoppelPaymer, Sodinokibi, Maze, and NetWalker, but there are no infrastructural overlaps or any other concrete evidence of a connection with other notorious groups.
Click to expand...

Digital Shadows: DarkSide: The New Ransomware Group Behind Highly Targeted Attacks

Although this operation displays a unique combination of tactics, communication, and ethical claims, DarkSide merely seems to be the latest product belonging to the growing trend of ransomware professionalization.
As RaaC continues to remain a popular method due to its rewarding financial return, we plan to see new threat groups with differing technical capabilities entering the ransomware Thunderdome.
Click to expand...

guest · Sep 23, 2020

Thieves Fail to Auction Bruce Springsteen's Legal Documents
September 23, 2020
https://www.infosecurity-magazine.com/news/bruce-springsteen-revil-auction/

Cyber-criminals hoping to profit from the theft of Bruce Springsteen's legal documents were left disappointed when an online auction of the data attracted no buyers.

Responsibility for the attack was claimed by the criminal gang behind REvil ransomware (also known as Sodinokobi), who demanded, but failed to get, a ransom to return the files.
Following the attack in May, the gang threatened to auction off data relating to Grubman Shire Meiselas & Sacks client Madonna, demanding a starting bid of $1m for the information. However, the gang reneged on their threat.
Click to expand...

Yesterday, the gang staged an auction on its Dark Web "Happy Blog" of "All Bruce Springsteen legal documents from Grubman office" in which interested buyers were invited to start with a more modest opening bid of $600,000. A blitz price option of $1,500,000 was also offered.
When no bidders came forward, the gang published the message "No one paid for this lot in time. So the data is published."

However, the gang did not share a link to where the allegedly published stolen data could be found, suggesting that the auction may have been nothing more than a bluff.
Click to expand...

guest · Sep 24, 2020

Mount Locker ransomware joins the multi-million dollar ransom game
September 24, 2020
https://www.bleepingcomputer.com/ne...e-joins-the-multi-million-dollar-ransom-game/

A new ransomware operation named Mount Locker is underway stealing victims' files before encrypting and then demanding multi-million dollar ransoms.

Starting around the end of July 2020, Mount Locker began breaching corporate networks and deploying their ransomware.
From ransom notes shared with BleepingComputer by victims, the Mount Locker gang is demanding multi-million dollar ransom payments in some cases.

For example, Mount Locker told one victim that they stole 400 GB of their data, and if they are not paid, they will contact the victim's competitors, the media, TV channels, and newspapers.
Ultimately, the victim did not pay, and their data was published to a ransomware data leak site.
Click to expand...

The MountLocker ransomware
Michael Gillespie, who analyzed the ransomware, told BleepingComputer that Mount Locker uses ChaCha20 to encrypt the files and an embedded RSA-2048 public key to encrypt the encryption key.

The Tor site is simply a chat service, where victims can negotiate the ransom or ask questions.
Unfortunately, the ransomware is secure, and there is no way to recover your files for free.
Click to expand...

guest · Sep 28, 2020

Baltimore ransomware attack was early attempt at data extortion, new report shows
September 25, 2020
https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/

The May 2019 ransomware attack against Baltimore that debilitated municipal services for weeks, cost the city government as much as to $18 million and led to the ouster of the city’s chief information officer also included an early attempt by hackers pressuring a victim into paying up by threatening to publish stolen data, according to research published this week by the cybersecurity company CrowdStrike.

In a blog post Thursday, the company said that two days after the Baltimore hack was reported, the actor behind it posted a message on the dark web threatening to expose or destroy the city’s compromised data, in an attempt to extort then-Mayor Bernard C. “Jack” Young into paying a ransom of about $76,000.
Click to expand...

Young refused to pay, but the message now sticks out as an early example of a step that’s since become typical of ransomware incidents.

“Although ineffective, the incident with the [City of Baltimore] and Outlaw Spider was the first instance observed by CrowdStrike Intelligence of data extortion to incentivize ransom payment,” the CrowdStrike blog reads.
In attempting to goad victims into paying ransoms by threatening to expose potentially sensitive information, Meyers said, negotiations between hacker and victim “are commoditized.”

“These guys are financially motivated, they’re in it for the money,” he said.
Click to expand...

CrowdStrike: Double Trouble: Ransomware with Data Leak Extortion, Part 1

Conclusion
Data extortion is not a new trend, but it seems to be growing in popularity to fuel ransomware operations. OVERLORD SPIDER is one of possibly many eCrime actors using data theft and extortion as the main driver for their operations — in fact, it is the only method used by this actor.
Data extortion is not a new trend, but it seems to be growing in popularity to fuel ransomware operations.

To date, the majority of ransomware operators engaged in BGH operations have adopted or threatened the data-theft-and-leak tactic, with the exception of INDRIK SPIDER and WIZARD SPIDER. It is also likely that less sophisticated ransomware operators will threaten data leaks, even if they do not have the capability to exfiltrate data, in order to capitalize on the current trend of data extortion by bluffing.
Click to expand...

guest · Sep 30, 2020

Hackers hit South African government fund for children and missing people
September 30, 2020
https://de.reuters.com/article/safr...for-children-and-missing-people-idUSL8N2GR2EQ

Hackers attacked a South Africa’s justice department fund last week, the department said on Wednesday, but said it did not receive any ransom demands.

They targeted a fund containing a pool of money held by the courts in trust on behalf of minors, unborn heirs and missing or absent persons, it said.

“The department confirms what appears to be an incident wherein unauthorised transactions may have been attempted on the Guardians fund at the Masters office Pietermartizburg,” Crispin Phiri, spokesman for the Department of Justice Constitutional Development (DOJ) said.
Two cyber crime experts, who have reviewed the matter, told Reuters the attack was orchestrated by DoppelPaymer ransomware - a malicious software - used by its namesake cybercriminal group.
Click to expand...

Reuters has reviewed screenshots of the DoppelPaymer “leak site” on the dark web listing two pdf files obtained from the judiciary website.

“The two files shown in the screenshot have been posted to their dark web ‘leak site’ as proof of the attack,” said Brett Callow, a threat analyst at global cyber security firm Emsisoft.
Click to expand...

guest · Oct 1, 2020

mood said: ↑

Netwalker ransomware hits Pakistan's largest private power utility
September 8, 2020
https://www.bleepingcomputer.com/ne...hits-pakistans-largest-private-power-utility/
Click to expand...

Hackers leak files stolen in Pakistan's K-Electric ransomware attack
October 1, 2020
https://www.bleepingcomputer.com/ne...en-in-pakistans-k-electric-ransomware-attack/

The Netwalker ransomware operators have published the stolen data for K-Electric, Pakistan's largest private power company, after a ransom was not paid.

In a statement to BleepingComputer, K-Electric denied that any data was stolen from the company.
Netwalker publishes stolen data
This week, Netwalker has released an 8.5 GB archive of files allegedly stolen from K-Electric during the September ransomware attack.
Pakistani cybersecurity firm Rewterz, who examined the archive contents, told BleepingComputer that it contains sensitive information like financial data, customer information, engineering reports, maintenance logs, and more.

BleepingComputer has contacted K-Electric for another statement but has not received a reply.
Click to expand...

guest · Oct 1, 2020

Ransomware gangs add DDoS attacks to their extortion arsenal
October 1, 2020
https://www.bleepingcomputer.com/ne...-add-ddos-attacks-to-their-extortion-arsenal/

A ransomware operation has started to utilize a new tactic to extort their victims: DDoS a victim's website until they return to the negotiation table.

After negotiations stalled in a recent ransomware attack, a SunCrypt ransomware affiliate DDoSed a victim's website.
When the victim logged back into the ransomware's Tor payment site, they were greeted by a message stating that SunCrypt was responsible for the DDoS and will continue the attack if negotiations do not continue.

"At the moment your website is down due to the efforts of our tech. Please send us a message asap or further actions will be taken," the SunCrypt ransomware operator warned a victim.
"We were in thr [sic] process on the negotiations and you didn't show up so further actions were taken," the threat actors stated.
Click to expand...

MalwareHunterTeam, who shared the chat with BleepingComputer, told us that this tactic ultimately led to the victim paying the ransom.
This tactic was particularly effective against this victim as they were a smaller organization that was already greatly affected by the ransomware attack.

By combining data theft, the threat of a data breach, lack of access to encrypted files, and now a DDoS attack, a smaller victim could have their operation completely shut down.
Click to expand...

guest · Oct 3, 2020

Egregor Ransomware Threatens ‘Mass-Media’ Release of Corporate Data
The newly discovered ransomware is hitting companies worldwide, including the GEFCO global logistics company
October 2, 2020
https://threatpost.com/egregor-ransomware-mass-media-corporate-data/159816/

A freshly discovered family of ransomware called Egregor has been spotted in the wild, using a tactic of siphoning off corporate information and threatening a “mass-media” release of it before encrypting all files.
[...] the code seems to be a spinoff of the Sekhmet ransomware (itself named for the Egyptian goddess of healing) – a link that was also noted by other researchers..

“We found similarities in both Sekhmet and Egregor ransomware, such as obfuscation techniques, functions, API calls and strings, such as %Greetings2target% and %sekhmet_data% changing to %egregor_data%,” Gustavo Palazolo, security researcher at Appgate, told Threatpost. “Furthermore, the ransom note is also fairly similar.”
As far as other technical details, “The sample we analyzed has many anti-analysis techniques in place, such as code obfuscation and packed payloads,” according to the firm’s research, announced Friday.

“Also, in one of the execution stages, the Egregor payload can only be decrypted if the correct key is provided in the process’ command line, which means that the file cannot be analyzed, either manually or using a sandbox, [...]”
Click to expand...

Overall, he said, it has the same sophistication level as other ransomware families, however Egregor implements a high number of anti-analysis techniques, such as code obfuscation and payload encryption.
So far though, no mass-media events have occurred.

“At the time of this advisory, there are at least 13 different companies listed in their ‘hall of shame,’ including the global logistics company GEFCO, which suffered a cyberattack last week,” according to the firm.
“To get payment details, the victim needs to navigate to the deep web link Egregor provided and get instructions from the attacker through a live chat, which we have not performed.”
Click to expand...

guest · Oct 3, 2020

mood said: ↑

University Hospital New Jersey hit by SunCrypt ransomware, data leaked
September 16, 2020
https://www.bleepingcomputer.com/ne...ersey-hit-by-suncrypt-ransomware-data-leaked/
Click to expand...

US hospital paid ransomware gang $670K to protect patient data
October 3, 2020
https://www.bleepingcomputer.com/ne...ransomware-gang-670k-to-protect-patient-data/

University Hospital New Jersey in Newark, New Jersey, paid a $670,000 ransomware demand this month to prevent the publishing of 240 GB of stolen data, including patient info.

After the SunCrypt operators publicly posted an archive of 48,000 documents belonging to UHNJ, a representative of the hospital contacted the threat actors via their dark web payment portal to negotiate the stopping of any further publishing of patient data.
Paid to protect their patients' data
In a conversation seen by BleepingComputer between the hospital and the ransomware operators, we get a glimpse into the strangely cordial negotiation of a criminal ransom demand.

After the hospital's private data was published on SunCrypt's data leak site, the hospital contacted the threat actors via their Tor payment site, where they were told that the ransom was $1.7 million. The attackers told them that this ransom, though, "is negotiable due to COVID-19 situation." [...]
Click to expand...

Data breach journalist 'Dissent Doe' of Databreaches.net recently reported that they contacted SunCrypt after noticing UHNJ's data was removed from the ransomware data leak site.

In a conversation, the SunCrypt ransomware operators told Dissent Doe that they would no longer target healthcare organizations.

"We don’t play with people’s lives. And no further attacks will be carried against medical organizations even in this soft way," SunCrypt told databreaches.net.
Unfortunately, this comes too late for UHNJ.
Click to expand...

guest · Oct 9, 2020

Software AG hit with ransomware: Crooks leak staffers' passports, want millions for stolen files
October 9, 2020
https://www.theregister.com/2020/10/09/software_ag_ransomware/

Software AG has seemingly been hit by ransomware, with the German IT giant itself telling the country's stock market it had been “affected by a malware attack.”

In a notification to the German stock market published earlier this week Software AG said: “The IT infrastructure of Software AG is affected by a malware attack since the evening of 3 October 2020.”
News of the “malware attack” has been slow to filter into the Anglosphere, though the German Press Agency newswire published a brief note that was syndicated on obscure investment websites yesterday evening.

That report also says “data from Software AG servers and employees' notebooks were downloaded.”
Click to expand...

Screenshots of the attackers’ ransom webpage seen by El Reg show scans of staffers’ passports, internal billing notes and what appears to be internal directories on a Windows-based system. Folder names suggest the contents could relate to Software AG customers in the US and Canada.

Brett Callow, a threat analyst with ransomware specialist firm Emsisoft, told The Register that the Clop ransomware variant, thought to have been used in this attack, is relatively new.

"Clop is a variant of CryptoMix and may be used by the group behind the Dridex banking trojan. Like REvil and NetWalker, it is primarily used to target enterprise networks, with known past victims including Prominent and ExecuPharm. Clop’s demands can run to the millions.”
We understand the ransom demand against Software AG runs into millions of dollars and will update this article if the company gives any more details.
Click to expand...

guest · Oct 10, 2020

mood said: ↑

World's largest cruise line operator Carnival hit by ransomware
August 17, 2020
https://www.bleepingcomputer.com/ne...ise-line-operator-carnival-hit-by-ransomware/
Click to expand...

Largest cruise line operator Carnival confirms ransomware data theft
October 9, 2020
https://www.bleepingcomputer.com/ne...ator-carnival-confirms-ransomware-data-theft/

Carnival Corporation, the world's largest cruise line operator, has confirmed that the personal information of customers, employees, and ship crews was stolen during an August ransomware attack.

The ransomware attack Carnival refers to took place on August 15, 2020, and it was disclosed via an 8-K form filed with the Securities and Exchange Commission (SEC) two days later, on August 17.
At the time, the company said that only one of its brands was affected in the ransomware incident and that it expected that "the security event included unauthorized access to personal data of guests and employees."
Click to expand...

Data theft confirmed in SEC filing
In a 10-Q form filed with the SEC yesterday, Carnival confirmed that the unknown ransomware gang was able to gain access to personal information of both customers and employees during the attack.

The discovery was made during an investigation led by a major cybersecurity firm hired by Carnival following the August 15 incident. The company also notified data regulators and relevant law enforcement agencies.

"While the investigation is ongoing, early indications are that the unauthorized third-party gained access to certain personal information relating to some guests, employees, and crew for some of our operations," Carnival said. "There is currently no indication of any misuse of this information."
Click to expand...

Even though the filing does not name the ransomware strain used to encrypt systems, BleepingComputer knows of more than 22 different ransomware operations that steal and leak sensitive documents and info as part of their attacks.
When contacted by BleepingComputer in August, Carnival said that they are "not planning to discuss anything beyond the 8K filing at this point since it is early in the investigation process."
Click to expand...

hawki · Oct 10, 2020

hawki said: ↑

"MAZE Claims Attack on US School System [Fairfax, VA -- 12th largest U.S. School system]

https://wtop.com/fairfax-county/202...airfax-county-school-system-with-ranswomware/
Click to expand...

"Private information spotted on dark web in fallout from Fairfax Co. schools cyberattack

Personal information stolen from Fairfax County Public Schools during a ransomware attack last month has appeared on the dark web, according to a news release from Virginia’s largest school system...

...some of the information released on the dark web included a spreadsheet from 2014 listing several hundreds of employees’ names, Social Security numbers and a few details about their health insurance..."

https://wtop.com/fairfax-county/202...in-fallout-of-fairfax-co-schools-cyberattack/

guest · Oct 10, 2020

The DRIF report analysed a Ryuk ransomware infection that took 29 hours from the point of the initial malicious email being sent and asked more than $6m in ransom https://thedfirreport.com/2020/10/08/ryuks-return/
— Virus Bulletin (@virusbtn) October 10, 2020
Click to expand...

DFIR Report: Ryuk’s Return

Intro
The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.

Ryuk has been one of the most proficient ransomware gangs in the past few years, with the FBI claiming $61 million USD having been paid to the group as of February 2020. Earlier in the year, the group grew a little quiet, but that seems to have changed in the past few weeks, with incidents like what occurred at UHS hospitals.
Case Summary
In this case, the actions began via a loader malware known as Bazar/Kegtap. Reports indicate an email delivery via malspam, which has been creeping up in volume over the month of September.
From the initial execution of the payload, Bazar injects into various processes including explorer.exe and svchost.exe, as well as, spawning cmd.exe processes [...]
Click to expand...

Impact
SMB was used to transfer the Ryuk executables. Then, RDP connections were made from the first compromised DC, and then, ransomware executed throughout the environment, starting with the Backup servers. On the backup server, prior to execution, the threat actors pulled up the wbadmin msc console.
Commands ran prior to ransom execution: [...]

The threat actors asked for more than $6 million but were willing to negotiate.
Click to expand...

guest · Oct 12, 2020

mood said: ↑

Software AG hit with ransomware: Crooks leak staffers' passports, want millions for stolen files
October 9, 2020
https://www.theregister.com/2020/10/09/software_ag_ransomware/
Click to expand...

Software AG Continues Efforts Against $20M Ransomware Attack
October 12, 2020
https://www.darkreading.com/attacks...against-$20m-ransomware-attack/d/d-id/1339160

Software AG, Germany's second-largest software company (after SAP) continues to struggle with a ransomware attack that has evolved into an extortion bid carrying a $20 million payoff demand.

The attack began on October 3 as a ransomware attack in which the attackers demanded the unusually high ransom in return for a decryption key. According to reporting from ZDNet, stolen confidential employee information began to be released on the Dark Web on October 9 after negotiations between the company and attackers failed.
As of today, Computer Weekly reports that online customer support and internal communications systems remain offline, though customer services are operational.
Click to expand...

Criminals attacked using Clop ransomware, first described in the wild in February 2019.
For more, read here and here.
Click to expand...

guest · Oct 15, 2020

Miami-based tech company suffers massive 1TB customer and business data leak
...leaked on Russian-language hacker forum after a ransomware attack
October 13, 2020
https://cybernews.com/security/miami-based-tech-company-suffers-massive-1tb-data-leak/

The Miami-based “value-added solutions and technology products” company Intcomex has suffered a major data breach, with nearly 1 TB of its users’ data leaked. The leaked data includes credit cards, passport and license scans, personal data, payroll, financial documents, customer databases, employee information and more.

Parts of the data were leaked on a popular Russian hacker forum for free, with the first part made available on September 14, 2020, and the second part on September 20. The leaker originally promised to release the entire stolen database over an undisclosed period of time.
Click to expand...

We informed Intcomex about the leak on September 21, 2020. An Intcomex spokesperson confirmed that this database belongs to them and told CyberNews:

“Intcomex internally detected and responded to a cyber attack involving some of our systems. [...] We also notified law enforcement. We are notifying affected parties as appropriate. Services provided to our partners have not been impacted. The security of our systems and data remains a top priority.”
It appears that the leak was made available due to a failed ransom negotiation (translated from Russian): [...]
Click to expand...

The data was freely available on a popular Russian hacking forum. Therefore, it’s reasonable to assume that a sizable portion of the forum had access to the data.
Click to expand...

guest · Oct 15, 2020

mood said: ↑

Fisher & Paykel docs released on dark web after ransomware attack
June 11, 2020
https://www.itwire.com/security/fisher-paykel-docs-released-on-dark-web-after-ransomware-attack.html
Click to expand...

Third lot of Fisher & Paykel documents leaked on dark web
October 14, 2020
https://www.itwire.com/security/third-lot-of-fisher-paykel-documents-leaked-on-dark-web.html

As in the case of the earlier leaks, the material released this time appears to be mostly financial data.

In the case of Fisher & Paykel, a first lot of documents was released in June and a second lot in July.
The company was contacted at those times but did not offer any comment about the incident.
Click to expand...

Contacted for comment, Brett Callow, a ransomware threat researcher with the security firm Emsisoft, that is based in New Zealand, said: "The fact that groups publish data in instalments is likely not to keep pressure on victims in the hope that they'll eventually pay up.
"Fisher & Paykel is to be commended for its decision not to pay. If more companies took a similar stance, ransomware would be less of a problem."
Click to expand...

guest · Oct 15, 2020

Crytek hit by Egregor ransomware, Ubisoft data leaked
October 15, 2020
https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/

The Egregor ransomware gang has hit game developer Crytek in a confirmed ransomware attack and leaked what they claim are files stolen from Ubisoft's network.

Ubisoft and Crytek are both well-known game developers with corporate headquarters in France and Germany, respectively.
This week, the Egregor ransomware game posted archives containing unencrypted files, stating that they were stolen from Ubisoft and Crytek in unrelated attacks.

While it has not been confirmed if the attack against Ubisoft is legitimate, BleepingComputer has confirmed that Crytek suffered a ransomware attack.
Click to expand...

Crytek hit by confirmed ransomware attack
In addition to encrypting the devices, the Egregor gang claims to have stolen unencrypted files from Crytek and leaked a 380MB archive on their data leak site.
This leaked data includes files related to WarFace, Crytek's canceled Arena of Fate MOBA game, and their network operations.
Ubisoft's Watchdogs Legion source code allegedly stolen
Egregor ransomware also claimed to have breached Ubisoft's network and stolen unencrypted data, including the source code for the upcoming Watch Dogs: Legion game.

As part of this leak, Egregor has posted a 20MB archive containing game assets the ransomware gang says are part of Ubisoft's Watch Dogs game.
Click to expand...

None of these game assets, though, prove that they were actually stolen from Ubisoft, and could easily have been obtained elsewhere.
Our emails to Ubisoft remain unanswered as well.
Click to expand...

guest · Oct 16, 2020

ThunderX Ransomware rebrands as Ranzy Locker, adds data leak site
October 16, 2020
https://www.bleepingcomputer.com/ne...rebrands-as-ranzy-locker-adds-data-leak-site/

ThunderX has changed its name to Ranzy Locker and launched a data leak site where they shame victims who do not pay the ransom.

ThunderX is a ransomware operation that was launched at the end of August 2020. Soon after launching, weaknesses were found in the ransomware that allowed a free decryptor to be released by Tesorion.
The ransomware operators quickly fixed their bugs and released a new version of the ransomware under Ranzy Locker name.
Meet the Ranzy Locker ransomware
Using a sample of the ransomware found by MalwareHunterteam and shared with BleepingComputer, we can get a deeper dive into how the ransomware operates.
Click to expand...

It should be noted that in previous versions of ThunderX, the ransomware operators communicated with victims via email rather than using a dedicated Tor site.
When a victim visits the Tor payment site, they will be greeted with a 'Locked by Ranzy Locker' message and be shown a live chat screen to negotiate with the threat actors.
Ranzy Locker launches a data leak site
Many ransomware gangs utilize a double-extortion attack method, which is to steal unencrypted files from a victim before they encrypt the devices on the corporate network.

This week, the Ranzy Locker gang released a data leak site called 'Ranzy Leak' to leak the data of victims who do not pay.
Click to expand...

guest · Oct 19, 2020

Cyber-attack on Mississippi Schools Costs $300k
October 19, 2020
https://www.infosecurity-magazine.com/news/cyberattack-on-mississippi-schools/

A Mississippi school district has voted to pay $300,000 to recover files that were encrypted during a suspected ransomware attack.

Superintendent Dr. Ken Barron told WLBT news that the school became aware of the cyber-attack on Monday, October 12. Barron did not state how the attackers had gained access to the system or what information had been compromised as a result of the incident.
The superintendent said that individuals would be notified about the incident if required by law. He stated that he had been advised against revealing any further details of the attack in case it jeopardized the investigation being carried out by federal law enforcement.
Click to expand...

The school board voted to pay a company $300,000 to recover the data that was encrypted by malware.

"Last week, the Yazoo County School District detected a potential cyber event impacting certain devices on our network. We took our IT systems offline to investigate and address. National cyber-security firms were engaged to assist. We also reported this to federal law enforcement," wrote Barron in a statement issued by the school
Click to expand...

guest · Oct 20, 2020

Ransomware Gang Donated Part of Ransom Demands to Charities
October 20, 2020
https://www.tripwire.com/state-of-s...-donated-part-of-ransom-demands-to-charities/

A budding ransomware group donated part of the ransom demands that it had previously extorted from its victims to two charities.

On October 13, the Darkside ransomware group announced the donations in a blog post on its dark web portal. As quoted by ZDNet:

As we said in the first press release – we are targeting only large profitable corporations. We think it’s fair that some of the money they’ve paid will go to charity. No matter how bad you think our work is, we are pleased to know that we helped change someone’s life.
The ransomware gang specifically made donations of 0.88 BTC (worth approximately $10,000) to two charities: Children International, a global non-profit organization dedicated to helping children in poverty, and The Water Project, an organization which works to provide clean water to villages in sub-Saharan Africa.
Click to expand...

What is clear is that this charitable act does not negate the harm Darkside caused to its victims. The monies it donated didn’t belong to the group in the first place.
Click to expand...

guest · Oct 21, 2020

Major Data Breach at Ohio School District
October 20, 2020
https://www.infosecurity-magazine.com/news/major-data-breach-at-ohio-school/

Cyber-criminals have exfiltrated data from an Ohio school district and published personal information of faculty, staff, and students online.

According to 13abc news, nearly 9GB of sensitive data belonging to Toledo Public Schools (TPS) has been exposed. Information leaked by attackers includes names, addresses, dates of birth, phone numbers, and Social Security numbers.
Since data is not typically stolen in a DDoS attack, it seems that the TPS system was also the victim of another cyber-attack in which malware was introduced that exfiltrated data.
Click to expand...

On September 14, ransomware gang Maze claimed to have attacked the Toledo Public School System, but the data dumped as proof of the hit related to a construction firm. However, a subsequent data dump carried out earlier this month by Maze has been confirmed to 13abc by several TPS staff members to contain data that belongs to TPS.
The full extent of the data breach is unclear, as Maze claims to have only published a small portion of the information it has exfiltrated from TPS.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches