Ransomware and Recent Variants

guest · Oct 13, 2020

International law firm Seyfarth discloses ransomware attack
October 13, 2020
https://www.bleepingcomputer.com/ne...aw-firm-seyfarth-discloses-ransomware-attack/

International law firm Seyfarth Shaw announced on Monday that it was the victim of a ransomware attack over the weekend.
With more than 900 lawyers in 17 offices in America, Europe, and the Asia Pacific regions, the company made over $700 million in gross revenue last year, placing it in the lower half of the top 100 highest-grossing law firm in the world.
Weekend attack
The incident occurred on Saturday, with the company describing it as a “sophisticated and aggressive malware attack.” The timing is typical for cyber attacks, ransomware in particular, as companies have fewer employees working weekends.

In its notification about the attack, Seyfarth Shaw says that as far as they know, “a number of other entities were simultaneously hit with this same attack.”
Click to expand...

“Our clients remain our top priority, and we will continue to do everything necessary to protect their confidential information and continue to serve them. We are coordinating with the FBI and are working around the clock to bring our systems back online as quickly and safely as possible” - Seyfarth Shaw
It is unclear how damaging this attack is, but Seyfarth Shaw says that they did not find evidence that the attackers accessed or stole client or company data.
Click to expand...

guest · Oct 13, 2020

City of Mt. Pleasant falls victim to remote ransomware attack
OIctober 12, 2020
https://nbc25news.com/news/local/city-of-mt-pleasant-falls-victim-to-remote-ransomware-attack

The City of Mt. Pleasant has fallen victim to a ransomware attack, that is according to city officials.

According to a press release on the city site, a remote Ransomware attack was detected on the city's computer and phone systems on Saturday morning.
Officials said the city's firewall remained secure and they do not plan to pay a ransom.

At this time, it is not believed any personal information has been breached.
Click to expand...

guest · Oct 14, 2020

Spotless hit by ransomware attack
Exclusive: Confirms a 'number' of servers 'accessed'
October 12, 2020
https://www.itnews.com.au/news/spotless-hit-by-ransomware-attack-554554

Spotless Group, the Downer-owned facilities services provider, is the latest high-profile Australian company to fall victim to ransomware attackers.

iTnews learned that the company had been attacked on Friday last week, and a Downer spokesperson confirmed the infection.

“We are investigating suspicious activity involving unauthorised access to a number of Spotless servers,” a spokesperson told iTnews.
It was unclear which of Spotless’ servers had been targeted by the attackers, however its public-facing website remains online.
Click to expand...

guest · Oct 16, 2020

MaMoCrypt Ransomware Decryption Tool
October 16, 2020
https://labs.bitdefender.com/2020/10/mamocrypt-ransomware-decryption-tool/

We’re happy to announce the availability of a new decryptor for MaMoCrypt, a strain of ransomware that appeared in December last year.
MaMoCrypt is an unusual piece of ransomware, a variant of MZRevenge written in Delphi and packed using mpress.

We have some bad news, though: because of improper configurations, the ransomware will only use the low DWORD of a file’s size and therefore, any file larger than 4GB will be permanently damaged. In short, only the remainder % 4GB will be encrypted and written, as seen in the image below.
Click to expand...

Apart from using an encryption scheme never seen in other ransomware, the binary will also not encrypt the entire system by merely iterating files, but it has a hardcoded list of folders and drives: [...]
Click to expand...

http://download.bitdefender.com/am/malware_removal/BDMaMoDecryptTool.exe

guest · Oct 16, 2020

The Week in Ransomware - October 16th 2020 - The weekend is upon us
October 16, 2020
https://www.bleepingcomputer.com/ne...are-october-16th-2020-the-weekend-is-upon-us/

Ransomware continues to target government entities and the enterprise, while victims quietly pay ransoms that power this cycle of attacks.
This week we learned that government software provider Tyler Technologies paid a ransom to obtain a decryptor for their attack.
[...]
It's now the beginning of the weekend when ransomware operators come out to play. Monitor your networks for suspicious activity and make sure your admin credentials are secure because there will be a slew of new victims come Monday.
Click to expand...

Minimalist · Oct 20, 2020

Ransomware statistics for 2020: Q3 report

Ransomware remained a persistent threat in Q3 2020. Threat actors continued to favor post-compromise deployment, often spending significant time preparing the target environment and exfiltrating data before delivering the ransomware payload. We also saw more ransomware groups seek to weaponize stolen data, with threat actors such as Avaddon, Conti, DarkSide, SunCrypt and LockBit, among others, launching new data leak sites this quarter.
Click to expand...

https://blog.emsisoft.com/en/37050/ransomware-statistics-for-2020-q3-report/

guest · Oct 22, 2020

Montreal's STM public transport system hit by ransomware attack
October 21, 2020
https://www.bleepingcomputer.com/ne...ic-transport-system-hit-by-ransomware-attack/

Montreal's Société de transport de Montréal (STM) public transport system was hit with a RansomExx ransomware attack that has impacted services and online systems.
On October 19th, STM suffered an outage that affected its IT systems, website, and customer support.

On Tuesday morning, STM announced that the outages were caused by a 'computer virus that caused a major failure on various platforms."
Later that evening, STM confirmed that they had suffered a ransomware attack and are working with law enforcement and external experts to restore their systems and investigate the attack.
RansomExx gang behind attack
According to a source familiar with the situation, STM suffered an attack by the RansomExx ransomware operation.
Click to expand...

guest · Oct 22, 2020

Sopra Steria hit by cyber attack. IT services group suspected of falling victim to ransomware
October 22, 2020
https://grahamcluley.com/sopra-steria-hit-by-cyber-attack/

European IT services group Sopra Steria has been hit by a cyber attack.

Which would be unfortunate for any business at the best of times, but is possibly even more galling for a firm like Sopra Steria which has a specialist cybersecurity branch which claims to help customers “protect sensitive information, and prevent costly data breaches.”
French media reports have claimed that the company has fallen foul of ransomware, but for now all Sopra Steria has confirmed in a terse official press release is that it has “detected” a “cyber attack” on its network: [...]
Click to expand...

Although it might be easy for those unaffected to be bemused by the irony of a company like Sopra Steria being hit by ransomware, it’s really a reminder that any organisation could potentially fall victim to a determined attack.
Click to expand...

guest · Oct 23, 2020

City of Shafter hit with ransomware attack
October 20, 2020
https://www.turnto23.com/news/local-news/city-of-shafter-hit-with-ransomware-attack

The City of Shafter has announced its IT system has been compromised by ransomware. An Instagram post says the city's IT system appears to be frozen and locked.

According to the city, it is not believed that any personal information has been obtained.
City officials are working with federal law enforcement agencies to determine the source and the extent of the unauthorized access.
Click to expand...

guest · Oct 23, 2020

WastedLocker ransomware hits Boyne Resorts ski resort operator
October 23, 2020
https://www.bleepingcomputer.com/ne...mware-hits-boyne-resorts-ski-resort-operator/

US-based ski and golf resort operator Boyne Resorts has suffered a cyberattack by the WastedLocker operation that has impacted company-wide reservation systems.

Boyne Resorts owns and operates eleven properties located in the USA and Canada and has 11,000 employees. Many of these properties are situated on well-known ski mountains, including Big Sky, Montana, Sugarloaf, Maine, and Brighton, Utah.
Boyne Resorts hit by WastedLocker ransomware
Today, BleepingComputer received an anonymous tip from an alleged Boyne Resorts employee who stated that the company suffered an undisclosed ransomware attack last weekend.

BleepingComputer has since confirmed with a second source that Boyne Resorts was attacked using the WastedLocker ransomware, the same one used in the attack on Garmin in July.
Click to expand...

guest · Oct 23, 2020

The Week in Ransomware - October 23rd 2020 - From Russia with Love
October 23, 2020
https://www.bleepingcomputer.com/ne...ware-october-23rd-2020-from-russia-with-love/

This week has been busy with ransomware related news, including new charges against Russian state-sponsored hackers and numerous attacks against well-known organizations.

We also learned of numerous attacks against large organizations, such as Barnes & Noble, the Monreal public transit system (STM), Sopra Steria, and Boyne Resorts. [...]
Click to expand...

guest · Oct 26, 2020

mood said: ↑

Sopra Steria hit by cyber attack. IT services group suspected of falling victim to ransomware
October 22, 2020
https://grahamcluley.com/sopra-steria-hit-by-cyber-attack/
Click to expand...

Sopra Steria Group: Cyberattack information update
October 26, 2020
https://www.soprabanking.com/news/sopra-steria-group-cyberattack-information-update/

On 21 October, Sopra Steria announced it had detected a cyberattack the previous evening.

The virus has been identified: it is a new version of the Ryuk ransomware, previously unknown to antivirus software providers and security agencies.
Sopra Steria’s investigation teams immediately provided the competent authorities with all information required. The Group was able to quickly make this new version’s virus signature available to all antivirus software providers, in order for them to update their antivirus software.

Moreover, it has also been established that the cyberattack was only launched a few days before it was detected.
Click to expand...

At this stage, and following in-depth investigation, Sopra Steria has not identified any leaked data or damage caused to its customers’ information systems.
It will take a few weeks for a return to normal across the Group.
Click to expand...

guest · Oct 27, 2020

Steelcase furniture giant hit by Ryuk ransomware attack
October 27, 2020
https://www.bleepingcomputer.com/ne...urniture-giant-hit-by-ryuk-ransomware-attack/

Office furniture giant Steelcase has suffered a ransomware attack that forced them to shut down their network to contain the attack's spread.

Steelcase is the largest office furniture manufacturer globally, with 13,000 employees and $3.7 billion in 2020.
Steelcase suffers a Ryuk ransomware attack
In an 8-K form filed with the Securities and Exchange Commission (SEC), Steelcase has disclosed that they were the victim of a cyberattack on October 22nd, 2020.

BleepingComputer has been actively tracking this attack after a source in the cybersecurity industry told us last week that Steelcase suffered a Ryuk ransomware attack.
We were told that Steelcase's devices were encrypted by Ryuk after first being targeted by the same group behind the recent attack on Sopra Steria and Universal Health Services.
Click to expand...

guest · Oct 28, 2020

Cyberattack strikes media-monitoring company used by Australian government
October 27, 2020
https://www.theguardian.com/technol...itoring-company-used-by-australian-government

A media-monitoring and analytics firm used by the federal government has been hit by a cyberattack, prompting the involvement of the nation’s leading cybersecurity agency.

Isentia, which boasts it has “most government departments and large corporations” as clients in Australia, told the Australian Stock Exchange on Tuesday it is “urgently investigating a cybersecurity incident” that was “disrupting services” involving its media portal – a service customers use to see media reporting on them, or issues of interest to them, and find journalists.

“Isentia is taking urgent steps to contain the incident and conduct a full investigation into what happened and how to avoid a repeat occurrence in the future,” chief executive Ed Harrison said, stating the company was focusing on restoring services.
Click to expand...

Guardian Australia understands the company had been hit by a ransomware attack, meaning its systems are encrypted and an attacker will only release it once money is paid.
External IT security contractors are leading the investigation and the company is working furiously to restore full service.
Click to expand...

guest · Oct 30, 2020

mood said: ↑

Montreal's STM public transport system hit by ransomware attack
October 21, 2020
https://www.bleepingcomputer.com/ne...ic-transport-system-hit-by-ransomware-attack/
Click to expand...

STM says it refused hackers' $2.8M demand in ransomware attack
Transit agency's website is still down, adapted transit back in service
October 29, 2020
https://www.cbc.ca/news/canada/montreal/stm-refused-to-pay-2-8-million-ransomware-attack-1.5782838

The hackers responsible for a ransomware attack on Montreal's transit agency have asked for $2.8 million, a sum the agency says it will not pay.

The Société de transport de Montréal (STM) says the attack targeted 1,000 of its 1,600 servers.
For the first time, it gave details about the outage.
Click to expand...

It said 624 operationally sensitive servers were affected by the attack — but more than three-quarters of them are back online now. The STM's website is still down though.
The attack did, however, stop the STM from providing adapted transit for nearly a week. That was reestablished Sunday.
Click to expand...

guest · Oct 30, 2020

The Week in Ransomware - October 30th 2020 - Hospitals under siege
October 30, 2020
https://www.bleepingcomputer.com/ne...ware-october-30th-2020-hospitals-under-siege/

This week we have seen a concerted attack against the healthcare industry by hacking groups utilizing the Ryuk ransomware. Also, we saw some large well-known companies suffer ransomware attacks that impacted their business operations.
Now that the weekend is upon us, it is important for all companies to monitor for suspicious activity on their networks and Windows domain controllers, and proactively respond if anything is detected.
Click to expand...

guest · Nov 2, 2020

mood said: ↑

Cyberattack strikes media-monitoring company used by Australian government
October 27, 2020
https://www.theguardian.com/technol...itoring-company-used-by-australian-government
Click to expand...

Isentia ransomware attack expected to cost at least $7 million
Mediaportal now operational, but some services still offline
November 3, 2020
https://www.itnews.com.au/news/isentia-ransomware-attack-expected-to-cost-at-least-7-million-555472

Media monitoring provider Isentia has put the immediate cost of a “significant” ransomware attack on its flagship intelligence and insights service last week at at least $7 million.

The incident, disclosed on Tuesday last week, disrupted the operation of the company's SaaS platform, Mediaportal.
Mediaportal is Isentia’s all-in-one platform used by both public and private sector communications professionals to stay across media coverage and identify journalists.

Isentia said it would not confirm the point of entry used by the attackers, nor share the indicators of compromise "at this time", citing ongoing investigations.
Click to expand...

Financial cost
Isentia described the incident as “significant as operations were severely compromised”, with a hit of between $7 million and $8.5 million expected on its pre-tax earnings this financial year.

“Isentia advises that the immediate impact on the company’s net profit before tax (NPBT) from the cyber security incident is expected to be a significant decline in the range of $7m to $8.5m in FY2021,” it said.
He added that the company “responded rapidly to the cyber attack last week putting in place measures to support our customers and contain the impact on our systems”.
Click to expand...

guest · Nov 3, 2020

X-Cart customers recovering from ransomware attack that led to widespread e-commerce site outages
November 2, 2020
https://portswigger.net/daily-swig/...hat-led-to-widespread-e-commerce-site-outages

A recent ransomware attack on a third-party software management tool caused outages for customers of e-commerce platform provider X-Cart.

The disruption, which sparked anguish and frustration among customers on X-Cart’s private forum, prompted one participant on the message board to tip off The Daily Swig.
Our tipster, who asked to remain anonymous, said X-Cart had to restore systems from backups, adding that there may be a time gaps since the last restoration that means data will be lost as a result of the incident.
Click to expand...

In response to queries from The Daily Swig, Jeff Cohen, vice president of marketing at X-cart, offered a statement last Thursday (October 29) confirming the incident but stating the problem was well in hand:

On October 21, 2020, at approximately 11 am EST, X-Cart in cooperation with our infrastructure provider identified that some of our servers were down due to a ransomware attack. All customer websites have since been restored.
The vulnerability was in a 3rd party software tool we used to manage our service infrastructure.
Meanwhile an investigation by X-Cart into the incident continues.
“At this time, we believe we know the third-party tool but do not want to disclose it until our security agency confirms and completes the audit,” Cohen explained.
Click to expand...

guest · Nov 3, 2020

Three-fourths of ransomware attacks in Florida targeted public sector
October 30, 2020
https://statescoop.com/florida-ransomware-public-sector/

Publicly disclosed ransomware attacks against entities in Florida spanning more than three years overwhelmingly targeted the public sector, according to a report published this week by researchers at the University of South Florida.

Of 18 incidents the report examined, 14, or 78%, involve a local-government victim. The list of targets includes cities, towns, counties, school districts and the Palm Beach County Supervisor of Elections.

“Ransomware is an increasing threat to Florida public and private sector institutions. Florida has experienced a massive uptick in ransomware incidents, starting in 2019, with significant monetary impact, as well as disruption of critical infrastructure,” reads the report [...]
The report only includes four private-sector attacks, affecting a prison services vendor, a car dealership, a facial reconstruction clinic and the Tampa Bay Times newspaper. But that likely understates the number of Florida companies that were hit with ransomware over the report’s timeframe [...]
Click to expand...

Research Report: Florida Ransomware Incidents 2016-2019

Ransomware continues to be a major threat to public and private sector institutions across the country. In 2019, the nation saw a dramatic increase in attacks targeting public entities, a trend that, unfortunately, continues to this day.
Click to expand...

guest · Nov 3, 2020

Leading toy maker Mattel hit by ransomware
November 3, 2020
https://www.bleepingcomputer.com/news/security/leading-toy-maker-mattel-hit-by-ransomware/

Toy industry giant Mattel disclosed that they suffered a ransomware attack in July that impacted some of its business functions but did not lead to data theft.

Mattel is the second-largest toymaker in the world with 24,000 employees and $5.7 billion in revenue for 2019.
In a 10-Q form filed with the Securities and Exchange Commission (SEC), Mattel disclosed that it suffered a ransomware attack on July 28th, 2020.
After conducting their investigation, Mattel does not believe that any data was stolen during the ransomware attack.

"A forensic investigation of the incident has concluded, and no exfiltration of any sensitive business data or retail customer, supplier, consumer, or employee data was identified," Mattel further stated in their filing.
The filing does not indicate what ransomware operation was responsible for the attack, but a source told BleepingComputer that Mattel suffered a TrickBot infection in July.
Click to expand...

guest · Nov 3, 2020

New RegretLocker ransomware targets Windows virtual machines
November 3, 2020
https://www.bleepingcomputer.com/ne...-ransomware-targets-windows-virtual-machines/

A new ransomware called RegretLocker uses a variety of advanced features that allows it to encrypt virtual hard drives and close open files for encryption.

RegretLocker was discovered in October and is a simple ransomware in terms of appearance as it does not contain a long-winded ransom note and uses email for communication rather than a Tor payment site.
When encrypting files, it will append the innocuous-sounding .mouse extension to encrypted file names.
Click to expand...

RegretLocker mounts virtual hard disks
In a sample of the ransomware discovered by MalwareHunterTeam and analyzed by Advanced Intel's Vitali Kremez, RegretLocker uses an interesting technique of mounting a virtual disk file so each of its files can be encrypted individually.

To do this, RegretLocker uses the Windows Virtual Storage API OpenVirtualDisk, AttachVirtualDisk, and GetVirtualDiskPhysicalPath functions to mount virtual disks.
In addition to using the Virtual Storage API, RegretLocker also utilizes the Windows Restart Manager API to terminate processes or Windows services that keep a file open during encryption.
Click to expand...

guest · Nov 5, 2020

Private Prison Operator GEO Group Discloses Data Breach
November 5, 2020
https://www.securityweek.com/private-prison-operator-geo-group-discloses-data-breach

Florida-based private prison operator GEO Group this week revealed that it was recently targeted in a cyberattack that involved ransomware and which may have resulted in the theft of sensitive information.

Once the breach was detected, the company rushed to cut off all connections between the compromised corporate servers and facilities, data centers and the corporate office. However, an investigation revealed that the attackers may have accessed personal and protected health information.
The exposed information includes name, address, date of birth, social security number, driver’s license number, employee ID number, and medical treatment and other health-related information.

“The Company recovered its critical operating data and the incident has not had a significant impact on the Company’s business operations or its ability to perform the services required under GEO’s contracts with its government customers to care for the individuals entrusted to GEO’s facilities and programs,” GEO said.
Click to expand...

guest · Nov 5, 2020

mood said: ↑

Government of Nunavut falls victim to ransomware attack
November 3, 2019
https://globalnews.ca/news/6120812/nunavut-ransomware-attack/
Click to expand...

One year after ransomware attack, the Nunavut government says all computer systems are restored
November 5, 2020
https://www.arctictoday.com/one-yea...nment-says-all-computer-systems-are-restored/

The Government of Nunavut says it has recovered from last November’s crippling malware attack on its computer network.

“All GN system applications have been restored to the functionality at the point of the ransomware attack,” the Community and Government Services Department said in an email to Nunatsiaq News.
But Elaine Keenan Bengts, Nunavut’s information and privacy commissioner, says that’s not the case.

She said the number of IT experts within the GN appeared to be limited and “most of them appear to be pre-occupied with the bigger issues with respect to [the] attack, and then with the requirements to allow employees to work from home during the pandemic.”
She said they had little time to devote to requests for recovery documents to respond to access to information requests.

“I suppose it was inevitable that the ransomware would be blamed for the inability to find records responsive to access requests and this is playing out now. How prevalent it becomes as an excuse for non-production of records remains to be seen,” Keenan Bengts said.
Click to expand...

guest · Nov 5, 2020

Cybercriminals Target Brazilian Government in a Ransomware Attack
November 5, 2020
https://blog.knowbe4.com/cybercriminals-target-brazilian-government-in-a-ransomware-attack

The bad guys managed to fully encrypt Brazil's Superior Court of Justice (SCJ), Ministry of Health, and Government of the DF this week. Technicians from SCJ discovered that there was a ransomware request that was up for negotiation.

There is still no official information on the possible identification of the criminals behind the attacks on the STJ, Ministry of Health, Government of the DF and more other public institutions this week. This could potentially be an attack by independent cybercriminals, and the STJ has not given an official statement on the issue.
Tecmundo has the full story.
Click to expand...

guest · Nov 6, 2020

The Week in Ransomware - November 6th 2020 - Video Games and Liquor!
November 6, 2020
https://www.bleepingcomputer.com/ne...are-november-6th-2020-video-games-and-liquor/

This week, it has been busy with attacks worldwide and one of the largest ransomware operations officially shutting down.

The week started with the official announcement from the infamous Maze operation that they were shutting down. BleepingComputer has learned that many of the affiliates are now moving over to a newer ransomware operation called Egregor.
We also learned of a new ransomware called RegretLocker that uses the Windows Virtual Storage APIs to mount virtual machine hard disks (VHDs) to encrypt each file contained in them individually.

Finally, we saw attacks on game developer Capcom, liquor make Campari, and a wide-scale assault on the Brazilian government networks. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches