Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Oct 23, 2020

Another REvil attack creates havoc for the Caribbean’s biggest conglomerate
Hack Attack
October 21, 2020
https://newsday.co.tt/2020/10/21/hack-attack-2/

The Caribbean's biggest conglomerate, Ansa McAl, is the victim of ransomware hackers holding some of the company’s IT systems hostage.

Newsday understands that work at Tatil, the country’s biggest insurer, has been effectively stalled for about two weeks as the IT department works to find and expel the ransomware from the company’s servers. If not, the company may have to pay the hackers’ ransom in order to free its data. In a statement late Tuesday evening, Ansa McAl said businesses were once again operational following a “security incident.”
It is unclear exactly what data and systems were compromised, but Newsday was told whatever was attacked is “very important (mission-critical) data that is crucial to Ansa’s operations.” Clients’ personal data was not compromised, Newsday was told.
Click to expand...

In a tweet last Thursday, American cybersecurity specialist and ransomware recovery and prevention expert Eric Taylor (@ITSimplife) first noted the Ansa McAl attack. REvil, a criminal cybergang, has claimed responsibility.

The group says it has “numerous financial documentation, agreements, invoices, reports.” A screenshot of the hacked haul reveals a count of 17,000 documents. The group threatened, in the post that confirmed the hack, to release the confidential documents to a public server.
Click to expand...

guest · Oct 26, 2020

LockBit Ransomware Uses Automation Tools to Pick Targets
October 23, 2020
https://www.databreachtoday.com/lockbit-ransomware-uses-automation-tools-to-pick-targets-a-15236

The operators behind the LockBit ransomware strain use several automation tools and techniques that help the crypto-locking malware spread quickly through a compromised network and assist in picking specific targets, according to a new analysis by security firm Sophos.

LockBit is one of several ransomware variants used for not only encrypting victims' data but also for exfiltrating that data to extort targets into paying the ransom to avoid having the data released.
LockBit avoids detection by many security tools, and it leaves few forensic traces, Sophos reports. The researchers, who looked at eight ransomware incidents targeting smaller firms, were able to piece together more details about how LockBit works.

"It's not clear what the initial compromise was across these organizations, as we had no visibility into the event," Sean Gallagher, senior threat researcher at Sophos, notes in the report. "But it appears all of the activity in the attacks we analyzed here were initiated from a single compromised server within the network used as the 'mothership' for the LockBit attack."
Click to expand...

Sophos: LockBit uses automated attack tools to identify tasty targets

Using renamed copies of PowerShell and Windows’VBscript host and scripts based on PowerShell pen-testing tool, LockBit actors searched for systems with valuable data to hit at small organizations.
Click to expand...

guest · Oct 27, 2020

Enel Group hit by ransomware again, Netwalker demands $14 million
October 27, 2020
https://www.bleepingcomputer.com/ne...ansomware-again-netwalker-demands-14-million/

Multinational energy company Enel Group has been hit by a ransomware attack for the second time this year. This time by Netwalker, who is asking a $14 million ransom for the decryption key and to not release several terabytes of stolen data.

Enel is one of the largest players in the European energy sector, with more than 61 million customers in 40 countries. As of August 10, it ranks 87 in Fortune Global 500, with a revenue of almost $90 billion in 2019.
Enel hit with Netwalker Ransomware attack
In early June, Enel's internal network was attacked by Snake ransomware, also referred to as EKANS, but the attempt was caught before the malware could spread.

Included in the ransom note, was a link to a http://prnt.sc/ URL that showed data stolen from the attack. Based on the names of the employees in the folders, it was determined that the attack was on Enel Group.
Click to expand...

A few days later, Netwalker confirmed that the victim was Enel Group after they added a message to their support chat, stating "Hello Enel. Dont be afraid to write us."

The attacker used this channel to announce that they would initiate the first step towards leaking the stolen data. This means publishing proof that they have the goods, an attempt to pressure the company into paying the ransom, which is now $14 million (1234.02380000 BTC).
Today, the Netwalker ransomware gang added Enel Group to their data leak site and shared screenshots of unencrypted files from the company during this month's cyberattack.
Click to expand...

guest · Oct 29, 2020

More Ransomware Creators Jump on the Leak Site Bandwagon as the Number of Sites and Data Breach Posts Skyrocket in Q3
October 29, 2020
https://blog.knowbe4.com/more-ranso...f-sites-and-data-breach-posts-skyrocket-in-q3

The third quarter saw massive increases in activity by ransomware gangs both creating leak sites and posting to them about recent attacks on orgs that, presumably, didn’t pay the ransom.

We’ve seen more and more interest in ransomware attacks turning into ransomware-turned-data-breach attacks and the use of the extortion of going public with the data breach as a means to further influence the victim organization to pay the ransom.
Click to expand...

Security vendor Digital Shadows’ Quarterly Update: Ransomware Trends In Q3 highlights their findings as ransomware groups adopt similar tactics:

Maze, DoppelPaymer, and Sodinokibi made up 80% of alerts of the leak sites

Conti and NetWalker ransomware groups joined the ranks of those hosting a leak site

The number of leak sites by well-known ransomware groups rose to 7 by the end of Q3

All this is bad news for organizations that aren’t truly prepared for Ransomware. It’s no longer a game of having backups, but being prepared for both a full-on data breach and a completely inoperable network.
Click to expand...

Digital Shadows: Quarterly Update: Ransomware Trends In Q3

As we embark on the final months of 2020, ransomware has been the main topic of conversation once again. Throughout Q3, it seemed like not only was there a new attack reported every day, but that new variants and new data leak sites were popping up each week.

Even further, Mount Locker ransomware was identified in the wild, Conti ransomware operators created new data leak sites, and attackers targeted the University of York in a ransomware attack. The list goes on and on.
THE EXFILTRATION SAGA CONTINUES
In the second quarter of 2020, Maze, DoppelPaymer, and Sodinokibi seemed to rule the ransomware scene with reports of ransomware attacks every day. In Q3 2020, Maze continued to make news headlines; however, more ransomware operators joined in on the data leak site trend.
Click to expand...

guest · Oct 31, 2020

REvil ransomware gang hacked gaming firm Gaming Partners International
October 31, 2020
https://securityaffairs.co/wordpres...-partners-international-revil-ransomware.html

Gaming Partners International (GPI) is a full-service supplier of gaming furniture and equipment for casinos worldwide. The REvil ransomware gang (aka Sodinokibi) claims to have stolen info from the systems at the company before encrypting them.

Recently, one of the members of the gang that goes online with the moniker UNKN, announced in an interview with Yelisey Boguslavskiy that they were planning an attack against a prominent organization in the gaming network.
The attack happened and today the REvil ransomware operators added Gaming Partners International to their dedicated leak site.
Click to expand...

The message published by the ransomware gang threatens to release the stolen data if the company will not pay the ransom within 72 hours.

The hackers claim to have stolen 540Gb of technical and financial documents stolen form the company.

“Absolutely all servers and working computers of the company are hacked and encrypted. There was a large data leak 540Gb of the most important information of the company, technical data, financial documents, contracts with ALL CASINO in LAS-VEGAS, MACAO, EUROPE, bank documents.” reads the message published by the ransomware operators.
Click to expand...

guest · Nov 2, 2020

Big US transportation services firm hit by Windows REvil ransomware
November 3, 2020
https://www.itwire.com/security/big...ice-firm-hit-by-windows-revil-ransomware.html

Publicly listed US transportation services firm Matson appears to have been hit by a gang of cyber criminals using the Windows REvil ransomware, with the thieves claiming to have stolen a terabyte of data.

Some screenshots of the stolen data has been released on the REvil site on the dark web, with the attackers claiming they have data on tax, logistics, and personal data on clients and employees.
Matson, which was founded in 1882, has annual revenue of about US$2 billion.
It has a subsidiary, Matson Navigation Company, that provides ocean shipping services across the Pacific to Hawaii, Alaska, Guam, Micronesia, the South Pacific, China and Japan, according to Wikipedia.
Click to expand...

iTWire contacted the company for comment on 28 October, but has not yet heard back.
The attackers warned that they would put up the stolen data for auction, and would release about 3GB of the data on dark web for prospective buyers to review.
Click to expand...

guest · Nov 3, 2020

mood said: ↑

Crytek hit by Egregor ransomware, Ubisoft data leaked
October 15, 2020
https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/
Click to expand...

The source code for Watch Dogs Legion has been leaked, weights around 560GB
November 3, 2020
https://www.dsogaming.com/pc-performance-analyses/source-code-watch-dogs-legion-leaked-560gb/

As we’ve already reported, in October 2020, ransomware gang “Egregor” has leaked data that it had obtained from the internal networks of Crytek and Ubisoft. And it appears that the source code for Watch Dogs Legion has been leaked online. The source code for this triple-A game is around 560GB, and it’s already available for download on various private trackers.

But what can the average PC Joe expect from the leak of Watch Dogs Legion’s source code? Well, for starters, mods. By accessing the source code, modders may find a way to enable mods for this game.
Furthermore, cracking groups may also find a way to crack the game’s anti-piracy measures.
Click to expand...

guest · Nov 4, 2020

50% of Ransomware Attacks Lead to Data Exfiltration; Payments Hit $234K
November 4, 2020
https://healthitsecurity.com/news/5...s-lead-to-data-exfiltration-payments-hit-234k

Threat actors are increasing threats to breach victims through extortion attempts, as data exfiltration now occurs in nearly 50 percent of ransomware attacks. Meanwhile, ransom payments rose 31 percent in the last quarter, at an average of $234,000, according to the Coveware Quarterly Ransomware Report.

Extortion techniques also continue to find success, as hackers have realized the same tactics and procedures used to successfully target smaller companies are just as effective at companies with thousands of employees, researchers explained.

“The biggest change over the past six quarters is threat actors now realize that their tactics scale to much larger enterprises without much of an increase in their own operating costs,” researchers wrote. “The profit margins are extremely high, and the risk is low.”
Click to expand...

Maze was the first group to popularize the double extortion attack method, which has pummeled the healthcare sector for more than a year. According to the research, it appears that Egregor and Sekhmet threat actors have since inserted Maze ransomware code into their variants.
Coveware thus named Egregor the “heir apparent.”

Notably, Egregor recently posted data allegedly stolen from HMS Holdings, a massive healthcare technology, analytics, and engagement vendor, to its dark web blog. Brett Callow, a threat analyst with Emsisoft, recently told HealthITSecurity.com that the threat emerged in September.

“Egregor appears to be a spin-off of Sekhmet, albeit far more active,” Callow said. “And like Sekhmet and multiple other groups, the actors behind Egregor exfiltrate data and use the threat of its release as additional leverage to extort payment.
The group’s claimed victims include Barnes and Noble, Ubisoft, a subsidiary of Berkshire Hathaway, a medical equipment manufacturer, and a hospital.”
Click to expand...

Coveware: Ransomware Demands continue to rise as Data Exfiltration becomes common, and Maze subdues

Half of the Ransomware Cases use Data Exfiltration as a Tactic - Exfiltrated Data Cases Doubled in Q3 2020
Almost 50% of ransomware cases included the threat to release exfiltrated data along with encrypted data. The threat to release exfiltrated data was used as a monetization conversion kicker.

Coveware feels that we have reached a tipping point with the data exfiltration tactic. Despite some companies opting to pay threat actors to not release exfiltrated data, Coveware has seen a fraying of promises of the cybercriminals (if that is a thing) to delete the data.
Click to expand...

guest · Nov 5, 2020

mood said: ↑

Newcastle University students' data held to ransom by cyber criminals
Hackers are demanding money from the university in order not to leak student and staff data stolen in the attack
September 7, 2020
https://news.sky.com/story/newcastl...ta-held-to-ransom-by-cyber-criminals-12066081
Click to expand...

Newcastle students’ data including home addresses leaked on dark web after cyber attack
Students at the Newcastle campus have not yet received any correspondence from the university
November 2, 2020
https://thetab.com/uk/newcastle/202...s-leaked-on-dark-web-after-cyber-attack-52213

A range of documents including Newcastle University students’ data has been leaked onto the dark web following the cyberattack that disrupted the university’s IT systems in September.

The files were leaked by cybercrime group Doppelpaymer on October 12th and include a full list of students, their specific departments, courses and student numbers.
The release of these documents follows the publication of subsidiary university documents on September 7th, which acted as proof that the cybercrime group had accessed the university’s server and obtained confidential documents.
Click to expand...

According to a post on their dark web site in September, Doppelpaymer threatened to release more confidential student and staff data unless they received payment.
Click to expand...

guest · Nov 5, 2020

Italian beverage vendor Campari knocked offline after ransomware attack
Campari has refused to engage with the ransomware gang and is restoring systems
November 5, 2020
https://www.zdnet.com/article/itali...pari-knocked-offline-after-ransomware-attack/

Campari Group, the famed Italian beverage vendor behind brands like Campari, Cinzano, and Appleton, has been hit by a ransomware attack and has taken down a large part of its IT network.

The attack took place last Sunday, on November 1, and has been linked to the RagnarLocker ransomware gang, according to a copy of the ransom note shared with ZDNet by a malware researcher who goes online by the name of Pancak3.
The RagnarLocker gang is now trying to extort the company into paying a ransom demand to decrypt its files.
Click to expand...

But the ransomware group is also threatening to release files it stole from Campari's network if the company doesn't pay its ransom demand in a week after the initial intrusion.
Screenshots of Campari's internal network and corporate documents have been posted on a dark web portal where the RagnarLocker gang runs a "leak site", as proof of the intrusion.

However, at the time of writing, Campari websites, email servers, and phone lines are still down, five days after the attack.
Click to expand...

guest · Nov 8, 2020

Val-de-Marne: Alfortville town hall paralyzed by a computer attack
November 6, 2020
https://www.archyde.com/val-de-marne-alfortville-town-hall-paralyzed-by-a-computer-attack/

The municipal computers were suddenly paralyzed Wednesday evening: “a general plantade”, in the words of the mayor PS of Alfortville (Val-de-Marne), Luc Carvounas. Its town hall was the target of a cyber attack by “ransomware”, that is to say that the hackers managed to enter the computer system and to exfiltrate, before encrypting them, all the files found on the way. .

City departments then received a ransom note in Bitcoin in exchange for a decryption key that makes access to files that have become unreadable.
The Town Planning and Population Assistance services are the most affected and the e-mail boxes no longer work. Windows PCs were infected, but macOS under macOS were not. The hacker group Ranzy Locker claimed responsibility for its action on the DarkWeb and created a file on its Ranzy Leak site dedicated to extortion and hosted on the parallel Tor network.

After having infiltrated a computer system with malware, another tool encrypts computers on the infected network. Folders and data then appear under the extension. Ranzy, according to analyzes carried out by the specialized site Bleeping Computer.
Click to expand...

Communities, ideal targets
Then comes the second stage of the extortion: they put some of the stolen loot online in order to put pressure on the victim to give in to their blackmail.

Alfortville refuses to pay the ransom and expects to restart his computer system in the middle of next week.
Click to expand...

guest · Nov 9, 2020

mood said: ↑

Italian beverage vendor Campari knocked offline after ransomware attack
Campari has refused to engage with the ransomware gang and is restoring systems
November 5, 2020
https://www.zdnet.com/article/itali...pari-knocked-offline-after-ransomware-attack/
Click to expand...

Campari staggers to its feet following $15 million Ragnar Locker ransomware attack
November 9, 2020
https://hotforsecurity.bitdefender....on-ragnar-locker-ransomware-attack-24499.html

Campari, the company famous around the world for its dark red alcoholic liqueur, says that it has managed to bring some of its IT systems back to working order after hackers attacked its network with ransomware.

However, a number of its IT systems remain suspended – either temporarily or deliberately – or are only capable of limited functionality while the IT teams attempts to restore operations in a secure way.
The company has made no statement about whether it would be prepared to pay the ransom or not, but for now it certainly sounds as if it has chosen to attempt to rebuild its services on multiple sites, adding additional security measures in a bid to prevent reinfection.
Click to expand...

Interestingly, researchers have linked the ransomware attack against Campari with that recently undertaken against video game developer Capcom.
On Twitter, MalwareHunter Team claimed that the Ragnar Locker ransomware samples used in both attacks were signed with the same digital certificate.
Click to expand...

guest · Nov 9, 2020

Laptop maker Compal hit by ransomware, $17 million demanded
November 9, 2020
https://www.bleepingcomputer.com/ne...compal-hit-by-ransomware-17-million-demanded/

Taiwanese laptop maker Compal Electronics suffered a DoppelPaymer ransomware attack over the weekend, with the attackers demanding an almost $17 million ransom.

Compal is the second-largest original design manufacturer (ODM) of laptops globally, with well-known companies rebranding their devices or designs, including Apple, HP, Dell, Lenovo, and Acer.
$16.7 million ransom demanded
Over the weekend, Taiwanese media reported that Compal suffered a cyberattack, but the laptop maker claimed it was just an "abnormality" in their office automation system.

"Lu Qingxiong said that the main reason was an abnormality in the office automation system. The company suspected of being invaded by hackers. It has urgently repaired most of it and is expected to return to normal today,"
"Lu Qingxiong emphasized that Compal is not being blackmailed by hackers, as is reported by the outside world, and everything is currently normal in production," UDN reported.
Click to expand...

According to the ransom note and DoppelPaymer's past history, the attackers likely stole unencrypted data as part of their attack.
This stolen data is then used as a double-extortion strategy where the ransomware gangs threaten to release the files on data leak sites if a ransom is not paid.
Click to expand...

guest · Nov 11, 2020

Newer Ransomware Groups Are Publishing Confidential Information Online, Kaspersky Analyzes
November 11, 2020
https://www.businesswire.com/news/h...dential-Information-Online-Kaspersky-Analyzes

Over the past couple of years, widespread ransomware attacks have been replaced by more targeted attacks against specific companies and industries. In these more targeted campaigns, attackers not only threaten to encrypt data but also to publish confidential information online. Kaspersky researchers observed this trend in a new analysis of two notable ransomware families: Ragnar Locker and Egregor.

Ransomware attacks used to be more widespread, but now, newer ransomware campaigns are modifying their modus operandi and threatening to take stolen company information public.
Ragnar Locker and Egregor are two well-known ransomware families practicing this new method of extortion.
Click to expand...

Ragnar Locker was first discovered in 2019, but it didn’t become well-known until the first half of 2020 when it was seen attacking large organizations. Attacks are highly targeted, with each sample specifically tailored to the intended victim. Those who refuse to pay have their confidential data published in the “Wall of Shame” section of the attackers’ leaks site. If the victim chats with the attackers and then refuses to pay, this chat is also published.

Egregor is much newer than Ragnar Locker, having first been discovered this past September. However, it uses many of the same tactics, and it also shares code similarities with Maze.
Egregor’s attack radius is much more extensive than Ragnar Locker’s. It’s been seen targeting victims across North America, Europe, and parts of the APAC region.

“What we’re seeing right now is the rise of ransomware 2.0,” said Dmitry Bestuzhev, head of the Latin American Global Research and Analysis Team (GReAT), Kaspersky.
Click to expand...

Kaspersky: Targeted ransomware: it’s not just about encrypting your data!

guest · Nov 11, 2020

Melbourne firm takes a hit from Windows REvil ransomware
November 10, 2020
https://www.itwire.com/security/melbourne-firm-takes-a-hit-from-windows-revil-ransomware.html

The company is part of the Nexia International Group that reported recenue of about US$4.3 billion ($A5.9 billion) in 2019.

The attackers claim to have stolen 76GB of data during the incident which took place recently.
The attackers have posted screenshots of a range of data on their web site on the dark web.

No data has been posted online as yet, indicating that the criminals may be waiting for the company to act on the ransom note which is normally generated after an attack of this nature.
Click to expand...

REvil, which is also known as Sodinokibi, has been used in many attacks this year. It was used to hit the publicly listed US transportation services firm Matson, big casino supplier Gaming Partners International Corporation, Meinhardt Group, an engineering consultancy with 51 offices worldwide and 5000 employees, American IT staffing company Artech Information Systems, and publicly traded professional distribution management firm DXP Enterprises.

Others to suffer were Adif, an infrastructure company owned by the Spanish Government, Argentina's biggest Internet service provider Telecom Argentina, leading retirement specialist Actuaries and Associates, the website of Cooke County in Texas, and Australian drinks manufacturer Lion.
Click to expand...

guest · Nov 12, 2020

New Pay2Key ransomware encrypts networks within one hour
November 6, 2020
https://www.bleepingcomputer.com/ne...ransomware-encrypts-networks-within-one-hour/

A new ransomware called Pay2Key has been targeting organizations from Israel and Brazil, encrypting their networks within an hour in targeted attacks still under investigation.

Michael Gillespie, the creator of ID Ransomware, has also seen submissions from Pay2Key victims predominantly from Brazilian IP addresses.
Encrypts networks within one hour
In a new report by Check Point, researchers say that the threat actors behind Pay2Key ransomware are likely using publicly exposed Remote Desktop Protocol (RDP) to gain access to victims' networks and deploy the initial malicious payloads.

While the Pay2Key operators infiltrate and are active in the targeted networks before the ransomware begins encrypting systems, they have the "ability to make a rapid move of spreading the ransomware within an hour to the entire network."
Click to expand...

Ransoms up to $140K
Just as in the case of other human-operated ransomware operations, Pay2Key actors will use Microsoft's legitimate PsExec portable tool to remotely execute ransomware payloads named Cobalt.Client.exe on the targeted organizations' network devices.

Pay2Key operators are currently asking for relatively low ransoms, with Check Point seeing them demand between 7 and 9 bitcoins (roughly $110K-$140K) per victim. BleepingComputer has seen ransom demands as low as 4 bitcoins (around $62K).

"While the attack is still under investigation, the recent Pay2Key ransomware attacks indicate a new threat actor is joining the trend of targeted ransomware attacks – presenting well-designed operation to maximize damage and minimize exposure," the Check Point researchers concluded.
Click to expand...

Check Point Resarch: Ransomware Alert: Pay2Key

Over the past week, an exceptional number of Israeli companies reported ransomware attacks. While some of the attacks were carried out by known ransomware strands like REvil and Ryuk, several large corporations experienced a full blown attack with a previously unknown ransomware variant names Pay2Key.
Click to expand...

guest · Nov 12, 2020

Researchers traced newly discovered sophisticated Pay2Key ransomware to Iran
November 12, 2020
https://cybernews.com/news/research...red-sophisticated-pay2key-ransomware-to-iran/

Early November, surprisingly many Israeli companies reported ransomware attacks. And while some of them were carried out by well-known ransomware strands like REvil and Ryuk, several large corporations experienced attacks by a previously unknown ransomware, now dubbed Pay2Key.

Most victims of these attacks were based in Israel. However, new evidence suggests a European victim, and researchers expect the ransomware gang to scale their attacks globally.
Researchers at Check Point emphasized that the Pay2Key ransomware strain is sophisticated and far more rapid than others. It encrypts its victims’ data in less than 1 hour. Currently, Pay2Key threat actors are asking for payments of 7 to 9 bitcoins (~$110K-$140K).
Click to expand...

Four victims of Pay2Key decided to pay the ransom, providing Check Point researchers an opportunity to follow the money. In collaboration with a blockchain intelligence firm Whitestream, Check Point researchers traced sequences of Bitcoin transactions to an Iranian cryptocurrency exchange named Excoino.

“So far, the Pay2Key threat actors have lived up to their threats. We strongly urge organizations to be cautious, as we expect their targeting to expand into other regions in the world.” Lotem Finkelsteen said.
The Pay2Key operators leverage a double extortion tactic. In the double extortion model, cybercriminals encrypt data and demand a ransom to regain access, and threaten to publish any exfiltrated data online if their terms are not met. Pay2Key threat actors have created a dedicated website to leak their victims’ data.
Click to expand...

Check Point Research: Pay2Key – The Plot Thickens

Last weekend we issued a ransomware alert about a wave of attacks using a never-seen-before strain dubbed ‘Pay2Key.’ Our investigation suggested the ransomware operators were mostly targeting Israeli companies. The ransomware used in the attacks spread rapidly across victims’ networks, leaving significant parts of the network encrypted along with a ransom note, threatening to leak stolen corporate data unless the ransom is paid.

In this follow up article, we will share some of our new findings, along with how we traced the Bitcoin transactions from the attackers’ ransom notes, all the way to an Iranian based Bitcoin exchange.
Click to expand...

guest · Nov 13, 2020

mood said: ↑

Melbourne firm takes a hit from Windows REvil ransomware
November 10, 2020
https://www.itwire.com/security/melbourne-firm-takes-a-hit-from-windows-revil-ransomware.html
Click to expand...

Melbourne firm denies data stolen during ransomware attack
November 12, 2020
https://www.itwire.com/security/melbourne-firm-denies-data-stolen-during-ransomware-attack.html

A spokesperson from Nexia Australia and New Zealand, a network of solutions-focused accountancy and consultancy firms, said the attack had taken place on 3 November and had been acted upon immediately.

An external IT consultant, Systima, was called in to deal with the incident and the spokesperson claimed that a report from the firm and a report from the Vocus exchange dated 11 November showed that no data had been exfiltrated.
"The matter was swiftly dealt with by our external providers and co-ordinated by our in-house ICT manager and we are advised that there is no evidence of any movement of data\files," the spokesperson said.
Click to expand...

The spokesperson claimed that iTWire had not made contact with the firm, even though an email seeking comment was sent to the company on the morning of 7 November using the only email address available on its website.
A report was published on 10 November, a day after the company was asked to respond with its version of events.
Click to expand...

guest · Nov 14, 2020

The Week in Ransomware - November 13th 2020 - Extortion gone wild
November 14, 2020
https://www.bleepingcomputer.com/ne...mware-november-13th-2020-extortion-gone-wild/

There were not many known large ransomware attacks this week, but we have seen ransomware operations evolving their tactics to extort their victims further.

The largest attack this week was against Tawainese laptop maker Compal, who was hit by DoppelPaymer. The threat actors are demanding $17 million to receive a decryptor and not to leak stolen files.
Ransomware operations have also begun new tactics this week to pressure their victims into paying a ransom.
After their attack on Campari, Ragnar Locker hacked a Facebook advertiser's account to run Facebook ads promoting their attack and threatening to release more data.
Click to expand...

Otherwise, this week has been mostly new variants of existing ransomware families.
Click to expand...

guest · Nov 14, 2020

Biotech research firm Miltenyi Biotec hit by Mount Locker ransomware
November 14, 2020
https://securityaffairs.co/wordpress/110900/malware/miltenyi-biotec-ransomware-attack.html

Biotech research firm Miltenyi Biotec was hit with a ransomware attack that took place in October and affected its IT infrastructure worldwide.

The company announced that it has fully restored systems after the attack, anyway in some countries local employees are still facing problems with mail and telephone systems.

“During the last two weeks, there have been isolated cases where order processing was impaired by malware in parts of our global IT infrastructure. Rest assured, all necessary measures have now been taken to contain the issue and recover all affected systems. Based on our current knowledge, we have no indication that the malware has been inadvertently distributed to customers or partners.” reads the announcement published by Miltenyi Biotec.
The company is not aware of data leak resulting from the malware infection. Customers should expect order delays caused by the incident that impacted their systems across the last two weeks.
Click to expand...

Miltenyi Biotec did not disclose the family of malware that infected its systems, anyway, Bleeping Computer speculates the involvement of Mount Locker ransomware.

“Even though Miltenyi Biotec has not disclosed the nature of the malware that caused the operational downtime during the last two weeks, the Mount Locker ransomware gang has claimed the attack earlier this month.” reported Bleeping Computer.
On November 4, 2020, Mount Locker ransomware operators have leaked on their data leak site (‘Mount Locker News & Leaks’) 5% out of the 150 GB of data they have allegedly stolen from the company.
Click to expand...

guest · Nov 14, 2020

Retail giant Cencosud hit by Egregor Ransomware attack, stores impacted
November 14, 2020
https://www.bleepingcomputer.com/ne...by-egregor-ransomware-attack-stores-impacted/

Chilean-based multinational retail company Cencosud has suffered a cyberattack by the Egregor ransomware operation that impacts services at stores.

According to Argentinian publisher Clarín, retail stores are still open, but some services are impacted.
For example, an Easy store in Buenos Aires is displaying a sign warning customers that they are not accepting the 'Cencosud Card' credit card, accepting returns, or allowing the pickup of web purchases due to technical problems.
Egregor behind ransomware attack
After learning of the attack, BleepingComputer obtain the ransom note and can confirm it was conducted by Egregor and targeted the 'Cencosud' Windows domain.
Click to expand...

BleepingComputer has learned from threat actors that many hackers who partnered with Maze are now working with Egregor.

Clarín also reported that printers in numerous retail outlets in Chile and Argentina, such as Easy home goods stores, began printing out ransom notes as devices are encrypted.
The ransom note does not provide links to proof of stolen data, but Egregor has a history of stealing unencrypted files before deploying their ransomware.

Egregor has been responsible for other high profile attacks on Crytek, Ubisoft, and Barnes and Noble.
BleepingComputer has contacted Cencosud with further questions but has not heard back.
Click to expand...

guest · Nov 16, 2020

American Bank Systems hit by ransomware attack, full 53 GB data dump leaked
American Bank Systems (ABS), a service provider to US banks and financial institutions has suffered a ransomware attack with some of its clients' data leaked
November 14, 2020
https://securityreport.com/american...ansomware-attack-full-53-gb-data-dump-leaked/

Avaddon ransomware hits American Bank Systems Inc.

American Bank Systems (ABS), a company that provides services to U.S. financial institutions and banks helping them “operate efficiently and confidently in a rapidly evolving – highly regulated – environment” has been hit by a ransomware attack this month.
Avaddon, the ransomware group behind the attack had earlier alleged they had acquired over 50 GB of the company’s proprietary data but had leaked a partial 4 GB dump earlier this month, part of which has been analyzed by Security Report News.
Click to expand...

The cyberattack is concerning as ABS’ clients included multiple banking names and mortgage companies, such as First Federal Community Bank, Rio Bank, Citizens Bank of Swainsboro, First Bank & Trust, etc.
By breaching ABS, threat actors may have therefore gained access to their clients’ data, and further the banking customers’ data.

It is not clear how many individual banking customers and financial organizations are impacted as a result of this breach.
Click to expand...

guest · Nov 17, 2020

Edinburgh Woollen Mill ransomware claim: Crims demand cash from target in administration
November 17, 2020
https://www.theregister.com/2020/11/17/edinburgh_woollen_mill_ransomware_egregor_claim/

Ransomware criminals who targeted Edinburgh Woollen Mill are congratulating themselves on infiltrating the business and publishing their usual extortion demands – unaware the company has crashed into administration.

When those demands weren’t answered, the gang – who had, as is fashionable for ransomware criminals, set up an extortion website – published a snippet of stolen data on their site to attract media attention.
There was just one problem. Nobody was paying attention to the ransom demands because Edinburgh Woollen Mill, parent company of clothing brands such as Jaeger and Jane Norman, as well as retail chain Peacocks, collapsed into administration a fortnight ago.
Click to expand...

Brett Callow, a threat analyst at infosec biz Emsisoft who spotted a post on Egregor's website about the alleged attack and showed us a screenshot, opined to El Reg:

“EWM is not the first company to be hit when close to being down and out. Such incidents could be coincidences, or they could be the result of security being diminished due to IT staff being let go.”
Egregor's operators published a zip file of what they claimed to be stolen data extracted from EWM.
Click to expand...

guest · Nov 20, 2020

Mount Locker ransomware now targets your TurboTax tax returns
November 19, 2020
https://www.bleepingcomputer.com/ne...omware-now-targets-your-turbotax-tax-returns/

The Mount Locker ransomware operation is gearing up for the tax season by specifically targeting TurboTax returns for encryption.

Mount Locker is a relatively new ransomware operation that began infecting victims in July 2020. Like other human-operated ransomware gangs, the Mount Locker gang will compromise networks, harvest unencrypted files to be used for blackmail, and then encrypt the devices on the network.
Stolen data and the encrypted files are then used in a double-extortion scheme where victims are warned that their stolen files will be published on a data leak site if a ransom is not paid.
Click to expand...

New Mount Locker version targets TurboTax
With the tax season fast approaching, some are already gathering their tax information and inputting it into TurboTax to prepare for the April 15th tax deadline.

In a new version of the ransomware analyzed by Advanced Intel's Vitali Kremez, Mount Locker is getting ready for the tax season as well by specifically targeting files used by the TurboTax tax software.
While Mount Locker is oddly targeting file extensions for specific tax years, Kremez told BleepingComputer that the 'tax' targeting would match all extensions that contain the string.
Click to expand...

guest · Nov 20, 2020

The former Coop fédérée is the target of cyber hackers in turn
Quebec’s largest agricultural company, Sollio Groupe coopératif, suffered a ransomware attack on November 7
The cyber hackers are threatening to publish the mass of data they have stolen in three days.
November 17, 2020
https://canadalive.news/2020/11/17/the-former-coop-federee-is-the-target-of-cyber-hackers-in-turn/

Sollio is still working on restarting his systems and has filed a complaint with the Montreal police.

“We have an investigation underway,” said Stéphane Forget, senior vice-president of corporate affairs, in an interview with our Investigation Office. We are following a critical path to rebuild and restart our systems. “
Multiple servers affected
The group refuses to say what proportion of its servers are affected, but the hackers attacked both the network of the head office and that of the agricultural division and cooperatives members of Sollio.
At this point, Sollio refuses to say if she has seen a ransom demand.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches