Ransomware and Recent Variants

Minimalist · Apr 22, 2021

Mount Locker Ransomware Aggressively Changes Up Tactics

The Mount Locker ransomware has shaken things up in recent campaigns with more sophisticated scripting and anti-prevention features, according to researchers. And, the change in tactics appears to coincide with a rebranding for the malware into “AstroLocker.”
Click to expand...

https://threatpost.com/mount-locker-ransomware-changes-tactics/165559/

guest · Apr 23, 2021

Ransomware gang wants to short the stock price of their victims
April 22, 2021
https://therecord.media/ransomware-gang-wants-to-short-the-stock-price-of-their-victims/

The operators of the Darkside ransomware are expanding their extortion tactics with a new technique aimed at companies that are listed on NASDAQ or other stock markets.

In a message posted on their dark web portal, the Darkside crew said it is willing to notify crooked market traders in advance so they can short a company’s stock price before they list its name on their website as a victim.
All of these tactics are usually deployed once ransomware gangs learn that a company whose data they stole and/or encrypted does not plan to pay the demanded ransom fee.
Click to expand...

Minimalist · Apr 23, 2021

Ransomware by the numbers: Reassessing the threat’s global impact

Kaspersky has been following the ransomware landscape for years. In the past, we’ve published yearly reports on the subject: PC ransomware in 2014-2016, Ransomware in 2016-2017, and Ransomware and malicious crypto miners in 2016-2018. In fact, in 2019, we chose ransomware as the story of the year, upon noticing the well-known threat was shifting its attention to municipalities. In the 2010s, with campaigns like WannaCry and NotPetya, ransomware became mainstream news. However, starting in 2018, we began noticing something else: the statistics for the overall number of ransomware detections were on a steep decline. What was happening? Was ransomware, in fact, a dying species of malware?
Click to expand...

https://securelist.com/ransomware-by-the-numbers-reassessing-the-threats-global-impact/

guest · Apr 23, 2021

The Week in Ransomware - April 23rd 2021 - A brutal week
April 23, 2021
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-23rd-2021-a-brutal-week/

This week has been brutal, not because of many ransomware variants released but due to a single ransomware campaign that affected thousands of people.
Last weekend started with a new infection called Nitro Ransomware that demanded Discord Nitro gift code rather than cryptocurrency to decrypt files.

It got really busy, though, on Tuesday when a Qlocker ransomware attack began exploiting vulnerabilities in QNAP NAS storage devices to encrypt device's files with the 7zip program.

This attack is the largest one this year that has affected the most people at once, ranging from business owners to consumers using their NAS devices to store family photos and movies. [...]
Click to expand...

Minimalist · Apr 24, 2021

What is extortionware?

Extortionware is the latest stage in the evolution of ransomware. No longer content with simply encrypting a victim’s files, threat actors are increasingly using ransomware incidents as an opportunity to steal huge swathes of sensitive data, which is then used as leverage in high-stakes extortion attempts.
Click to expand...

https://blog.emsisoft.com/en/38394/what-is-extortionware/

Minimalist · Apr 24, 2021

Apple’s ransomware mess is the future of online extortion

The connection to Apple and dramatic timing generated buzz about the attack. But it also reflects the confluence of a number of disturbing trends in ransomware. After years of refining their mass data encryption techniques to lock victims out of their own systems, criminal gangs are increasingly focusing on data theft and extortion as the centerpiece of their attacks—and making eye-popping demands in the process.
Click to expand...

https://arstechnica.com/information...mware-mess-is-the-future-of-online-extortion/

guest · Apr 24, 2021

A ransomware gang made $260,000 in 5 days using the 7zip utility
April 24, 2021
https://www.bleepingcomputer.com/ne...ade-260-000-in-5-days-using-the-7zip-utility/

A ransomware gang has made $260,000 in just five days simply by remotely encrypting files on QNAP devices using the 7zip archive program.

Starting on Monday, QNAP NAS users from all over the world suddenly found their files encrypted after a ransomware operation called Qlocker exploited vulnerabilities on their devices.
While most ransomware groups put considerable development time in their malware to make it efficient, feature-rich, and have strong encryption, the Qlocker gang didn't even have to create their own malware program.
Click to expand...

However, Qlocker chose a different target - consumers and small-to-medium business owners utilizing QNAP NAS devices for network storage.

It seems that the threat actors knew their targets well as they priced their ransom demands at only 0.01 Bitcoins, or at today's Bitcoin prices, approximately $500.
However, paying $500 can be seen as a small price to pay to recover important files, no matter how violated a victim may feel.

At this time, the 20 bitcoin addresses, shown below, have received ransom payments totaling 5.25735623 Bitcoins. This amount is equivalent to approximately $258,494.
Click to expand...

guest · Apr 26, 2021

Mining technology company Gyrodata hit by ransomware attack – employee data leaked
Sensitive personal details possibly stolen
April 23, 2021
https://portswigger.net/daily-swig/...hit-by-ransomware-attack-employee-data-leaked

A ransomware attack against mining technology organization Gyrodata has potentially leaked the sensitive information of current and former employees.
Based in the US, Gyrodata offers services such as directional drilling and surveying for energy companies.

In a statement released last night (April 22), Gyrodata said it has been the victim of a ransomware attack that led to a possible data breach.
Click to expand...

The attack was discovered on February 21, after which Gyrodata said it “immediately took steps to secure its systems” by launching an investigation and employing a cybersecurity company to assist.
Gyrodata also notified federal law enforcement of the incident and “continues to support their investigation”, the release reads.
Click to expand...

Minimalist · Apr 26, 2021

Ransomware gang now warns they will leak new Apple logos, iPad plans

The REvil ransomware gang has mysteriously removed Apple's schematics from their data leak site after privately warning Quanta that they would leak drawings for the new iPad and new Apple logos.
Click to expand...

https://www.bleepingcomputer.com/ne...ns-they-will-leak-new-apple-logos-ipad-plans/

Minimalist · Apr 27, 2021

The cost of ransomware in 2021: A country-by-country analysis

Ransomware has caused hundreds of billions of dollars of economic damage in the past 12 months.

As the world struggled to navigate the challenges of the pandemic, ransomware gangs thrived, with the increased adoption of data exfiltration helping create a lucrative year for the criminals – and a costly and extremely disruptive year for victims.
Click to expand...

https://blog.emsisoft.com/en/38426/the-cost-of-ransomware-in-2021-a-country-by-country-analysis/

Minimalist · Apr 27, 2021

Ransomware demands up by 43% so far in 2021, Coveware says

The average demand for a digital extortion payment shot up in the first quarter of this year to $220,298, up 43% from the previous quarter, according to a quarterly report from Coveware, a ransomware response firm. The median payment, too, jumped up 58% from from $49,450 to $78,398.
Click to expand...

https://www.cyberscoop.com/ransomware-extortion-demands-increasing-coveware/

Minimalist · Apr 29, 2021

Babuk ransomware readies 'shut down' post, plans to open source malware

After just a few months of activity, the operators of Babuk ransomware briefly posted a short message about their intention to quit the extortion business after having achieved their goal.

Unlike other gangs that chose to release decryption keys or even return the collected ransoms, Babuk's final gesture is to pass the torch to others.
Click to expand...

https://www.bleepingcomputer.com/ne...-shut-down-post-plans-to-open-source-malware/

Minimalist · Apr 29, 2021

QNAP finds evidence of AgeLocker ransomware activity in the wild

QNAP customers are once again urged to secure their Network Attached Storage (NAS) devices following a massive Qlocker ransomware campaign earlier this month.

In a security advisory published earlier today, the company says that its security team has discovered AgeLocker ransomware samples in the wild, with "the potential to affect QNAP NAS devices."
Click to expand...

https://www.bleepingcomputer.com/ne...of-agelocker-ransomware-activity-in-the-wild/

guest · Apr 30, 2021

“Hello” Ransomware Now Targets SharePoint Flaw for Entrance
April 28, 2021
https://www.technadu.com/hello-ransomware-now-targets-sharepoint-flaw-entrance/269849/

The “Hello” ransomware is exploiting a two-year-old vulnerability to find its way into unpatched systems.

The malware uses strong encryption and performs several checks to ensure maximum damage on the first attempt.

Patching remains the best proactive approach to deal with the particular threat.

Click to expand...

Even though the “CVE-2019-0604” was listed in a “2020 most exploited vulnerabilities to patch” report compiled by CISA, and although Microsoft fixed this via a Tuesday Patch a long time ago, the authors of the “Hello” (WickrMe) ransomware have added it on their tool, and it is reportedly working well.
As the Trend Micro threat analyst Janus Agcaoili reports, there are apparently enough unpatched SharePoint systems out there that make it worth using a modified version of the China Chopper web shell.
Click to expand...

Trend Micro: Hello Ransomware Uses Updated China Chopper Web Shell, SharePoint Vulnerability

We discuss the technical features of a Hello ransomware attack, including its exploitation of CVE-2019-0604 and the use of a modified version of the China Chopper web shell.
Click to expand...

Minimalist · Apr 30, 2021

Babuk quits ransomware encryption, focuses on data-theft extortion

A new message today from the operators of Babuk ransomware clarifies that the gang has decided to close the affiliate program and move to an extortion model that does not rely on encrypting victim computers.

The explanation comes after yesterday the group posted and deleted two announcements about their plan to close the project and release the source code for the malware.
Click to expand...

https://www.bleepingcomputer.com/ne...e-encryption-focuses-on-data-theft-extortion/

guest · Apr 30, 2021

The Week in Ransomware - April 30th 2021 - Attacks Escalate
April 30, 2021
https://www.bleepingcomputer.com/ne...-ransomware-april-30th-2021-attacks-escalate/

Ransomware gangs continue to target organizations large and small, including a brazen attack on the Washington DC police department.
This week, we learned of attacks affecting the Metropolitan Police Department, Merseyrail UK rail operator, the Whistler Resort Municipality, and an attack on Brazil's court systems in Rio Grande do Sul. [...]
Click to expand...

guest · May 1, 2021

Swiss Cloud becomes the latest web hosting provider to suffer a ransomware attack
May 1, 2021
https://therecord.media/swiss-cloud...sting-provider-to-suffer-a-ransomware-attack/

Swiss Cloud, a Switzerland-based cloud hosting provider, has suffered this week a ransomware attack that brought the company’s server infrastructure to its knees.

The incident took place on Tuesday, April 27, according to Swiss Cloud’s status page.
The company, which is one of Switzerland’s largest hosting providers, said on Friday in an update posted on its website[PDF] that it’s working to restore affected servers from existing backups.
Click to expand...

More than 6,500 customers affected
While the incident did not impact the company’s entire server infrastructure—spread among different data centers across Switzerland—the disruption has impacted server availability for more than 6,500 customers.
One of the most high-profile customers impacted by Swiss Cloud’s outage is Sage, a company that provides payroll and HR software for German-speaking countries.
Click to expand...

guest · May 2, 2021

TRB’s Registration Database Hacked in Ransomware Attack
April 30, 2021
https://www.ttnews.com/articles/trbs-registration-database-hacked-ransomware-attack

The Transportation Research Board’s annual meeting registration services database was compromised in March by cybercriminals in a ransomware attack, the organization announced April 28.
The vendor, J. Spargo & Associates Inc., based in Fairfax, Va., alerted TRB to the hack on March 14, TRB said.

“As a result of the attack, personal information for those who registered for TRB annual meetings from 2015-2021, may have been exposed and obtained in the attack,” TRB said in an email to all conference registrants since 2015.
The vendor told TRB that to protect data and mitigate potential identity theft, it met the cybercriminal’s ransomware demand. The vendor has advised TRB that it received assurances from the cybercriminal and third-party forensic experts that the data were not further disseminated, and that Spargo believes the data accessed by the cybercriminal has not been misused.
Click to expand...

Spargo did not respond to a request for comment at press time. In a LinkedIn post, Spargo’s owner, John Spargo, said that for years his company has been involved with events worldwide.

“Although we do not yet know all the details of this breach, in the spirit of transparency, TRB wanted to share what we do know at this time and what we are doing to address it,” Neil Pedersen, TRB’s executive director, said in a statement to Transport Topics.
Click to expand...

guest · May 3, 2021

Health care giant Scripps Health hit by ransomware attack
May 3, 2021
https://www.bleepingcomputer.com/ne...iant-scripps-health-hit-by-ransomware-attack/

Nonprofit health care provider Scripps Health in San Diego is currently dealing with a ransomware attack that forced the organization to suspend user access to its online portal and switch to alternative methods for patient care operations.

Following the attack, patient services have been offline and some critical-care patients have been redirected to other hospitals, according to local media reports.
The organization added that work was done using established backup processes. According to The San Diego Union-Tribune, medical personnel was relying on paper records and electronic monitoring of a patient’s vitals have also been affected by the attack.
Click to expand...

Scripps Health is working to return to normal operations and has informed law enforcement and government organizations of the situation.
The health care provider has five hospitals and 19 outpost facilities with over 2,600 affiliate physicians. Every year, Scripps Health treats more than 700,000 patients, as per data from Fortune.
Click to expand...

ronjor · May 6, 2021

CISA Releases Analysis Reports on New FiveHands Ransomware

Original release date: May 06, 2021
CISA is aware of a recent, successful cyberattack against an organization using a new ransomware variant, known as FiveHands, that has been used to successfully conduct a cyberattack against an organization.
CISA has released AR21-126A: FiveHands Ransomware and MAR-10324784-1.v1: FiveHands Ransomware to provide analysis of the threat actor’s tactics, techniques, and procedures as well as indicators of compromise (IOCs). These reports also provide CISA’s recommended mitigations for strengthening networks to protect against, detect, and respond to potential FiveHands ransomware attacks.
Click to expand...

CISA encourages organizations to review AR21-126A and MAR-10324784.r1.v1 for more information.
Click to expand...

Minimalist · May 7, 2021

Insurer AXA halts ransomware crime reimbursement in France

In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals.

AXA, among Europe’s top five insurers, said it was suspending the option in response to concerns aired by French justice and cybersecurity officials during a Senate roundtable in Paris last month about the devastating global epidemic of ransomware.
Click to expand...

https://abcnews.go.com/Technology/w...ansomware-crime-reimbursement-france-77540351

guest · May 7, 2021

The Week in Ransomware - May 7th 2021 - Attacking healthcare
May 7, 2021
https://www.bleepingcomputer.com/ne...ransomware-may-7th-2021-attacking-healthcare/

While ransomware attacks continued throughout the week, for the most part, it has been quieter than usual, with only a few new variants released.

The biggest news was the attack on health care giant Scripps Health whose operations were severely impacted by a ransomware attack.
We also saw a new ransomware called N3TW0RM targeting Israeli companies using an interesting client-server encryption method.
Finally, we learned that Cuba Ransomware is now partnered with Hancitor to compromise and encrypt corporate networks more quickly. [...]
Click to expand...

Minimalist · May 10, 2021

US and Australia warn of escalating Avaddon ransomware attacks

The Federal Bureau of Investigation (FBI) and the Australian Cyber Security Centre (ACSC) are warning of an ongoing Avaddon ransomware campaign targeting organizations from an extensive array of sectors in the US and worldwide.
Click to expand...

https://www.bleepingcomputer.com/ne...arn-of-escalating-avaddon-ransomware-attacks/

guest · May 10, 2021

Three Affiliated Tribes Hit by Ransomware Attack, Holding Tribal Information Hostage
May 7, 2021
https://nativenewsonline.net/curren...ware-attack-holding-tribal-information-hostag

On April 28, the Three Affiliated Tribes—the Mandan, Hidatsa & Arikara Nation—announced to its staff and employees that its server was hacked and believe it was by malicious software called ransomware. Since the server was hacked, the tribe has been unable to access files, email and critical information.

“MHA's management information system has been exposed to an external cyber security issue and we have formulated a team of experts to assist our analysis and have coordinated with external government entities as well,” said MHA Nation Tribal Chairman Mark Fox in an email to Native News Online.

“Ransomware is running rampant in governments throughout the world,” said National Association of State Chief Information Officers (NASCIO) Director of Policy & Research Meredith Ward in an email to Native News Online. “Many local governments have been hit very hard.”
Click to expand...

guest · May 10, 2021

City of Tulsa's online services disrupted in ransomware incident
May 10, 2021
https://www.bleepingcomputer.com/ne...ne-services-disrupted-in-ransomware-incident/

The City of Tulsa, Oklahoma, has suffered a ransomware attack that forced the City to shut down its systems to prevent the further spread of the malware.

Over the weekend, threat actors deployed a ransomware attack on the City of Tulsa's network that led to the City shutting down all of its systems and disrupting online services.

"We identified malware on our servers and as soon as we did that, in an abundance of caution, we shut all of our systems down." Tulsa Mayor GT Bynum told local media KRMG in an interview.
However, the shutdown of City systems is preventing residents from accessing online bill payment systems, utility billing, and services through email. Websites for the City of Tulsa, the Tulsa City Council, Tulsa Police, and the Tulsa 311 websites are also down for maintenance.
Click to expand...

In a Facebook post, the City states that customer information has not been compromised. As most ransomware operations steal data before deploying their ransomware, some amount of files was stolen.

"The City of Tulsa is experiencing technical difficulties on many outward facing programs that help serve the citizens of Tulsa due to a ransomware attack. No customer information has been comprised, but residents will not be able to access City websites and there will be delays in network services," says a post to the Tulsa Police Department's Facebook page.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Useful Searches