Ransomware and Recent Variants

guest · Jan 11, 2020

Panama-Buena Vista Union School District hit with ransomware attack
January 10, 2020
https://www.turnto23.com/news/local...on-school-district-hit-with-ransomware-attack

The Panama-Buena Vista School District is under a ransomware attack, causing a technology and phone outage at schools. That's according to a message sent to parents and staff from the district superintendent, Kevin Silberberg.
According to the message, District IT staff is working to resolve the issue.
Click to expand...

guest · Jan 11, 2020

The Week in Ransomware - January 10th 2020 - Now Data Breaches
January 11, 2020
https://www.bleepingcomputer.com/ne...nsomware-january-10th-2020-now-data-breaches/

This week we have seen new ransomware operators targeting businesses, stolen data published, and the Sodinokibi Ransomware being confirmed as behind the Travelex cyber attack.

Ransomware operators targeting the enterprise and stealing data before encrypting computers is the new normal and businesses need to start changing how they react to these types of attacks.
These attacks no longer only affect the company who was encrypted, but also their customers and employees whose personal data was stolen.
This is further exacerbated by Sodinokibi Ransomware getting into the game of releasing stolen data for non-payment and new ransomware variants such as Ako and Snake that are targeting entire networks rather than individual computers. [...]
Click to expand...

guest · Jan 11, 2020

mood said: ↑

Another Ransomware Will Now Publish Victims' Data If Not Paid
December 12, 2019
https://www.bleepingcomputer.com/ne...re-will-now-publish-victims-data-if-not-paid/
Click to expand...

Sodinokibi Ransomware Publishes Stolen Data for the First Time
January 11, 2020
https://www.bleepingcomputer.com/ne...are-publishes-stolen-data-for-the-first-time/

For the first time, the operators behind the Sodinokibi Ransomware have released files stolen from one of their victims because a ransom was not paid in time.
Since last month, the representatives of the Sodinokibi, otherwise known as REvil, have publicly stated that they would begin to follow Maze's example and publish data stolen from victims if they do not pay a ransom.

While there have been threats made against Travelex and CDH Investments, they have not carried through with them.
This all changed today when the public representative of Sodinokibi stated they beginning to "keep promises" as they posted links to approximately 337MB of allegedly stolen victim files on a Russian hacker and malware forum.

They claim this data belongs to Artech Information Systems, who describe themselves as a "minority- and women-owned diversity supplier and one of the largest IT staffing companies in the U.S", and that they will release more if a ransom is not paid.
Click to expand...

guest · Jan 11, 2020

Hackers attack City of Dawson Creek's computer systems
Mayor says attack was isolated quickly, no data appears to be lost
January 11, 2020
https://www.cbc.ca/news/canada/british-columbia/dawson-creek-hacking-malware-1.5423118

The City of Dawson Creek says its computer systems were hacked Thursday in an apparent ransomware attack.
In a notice posted online, Mayor Dale Bumstead said city files were temporarily encrypted, making them impossible to access.

The City of Dawson Creek says it expects to have a full update for residents by Monday afternoon, and that the city's insurance would pay for the cost of analyzing the attack.
Click to expand...

Minimalist · Jan 12, 2020

The five: ransomware attacks

Software that demands money with menaces has hit the big time. Here are some of its most lucrative forms
Click to expand...

https://www.theguardian.com/technology/2020/jan/12/the-five-ransomware-attacks-nhs-travelex

Minimalist · Jan 12, 2020

Sodinokibi Ransomware Hits New York Airport Systems

Albany International Airport's staff announced that the New York airport's administrative servers were hit by Sodinokibi Ransomware following a cyberattack that took place over Christmas.
Click to expand...

https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-new-york-airport-systems/

guest · Jan 12, 2020

mood said: ↑

Wood County Schools investigating ransomware attack
November 8, 2019
https://www.wtap.com/content/news/W...gating-possible-computer-virus-564620841.html
Click to expand...

Recovery continues in Wood County schools after 2019 ransomware attack
January 12, 2020
http://wvmetronews.com/2020/01/12/r...-county-schools-after-2019-ransomware-attack/

The new year is underway in public schools in Wood County with recovery work still continuing following last fall’s ransomware attack that knocked the entire school system offline.

“Everything’s up and running at this time, but we’re still working through a couple of kinks in our technological systems,” Will Hosaflook, Wood County superintendent of schools, recently told MetroNews.
The entire management system used previously was lost in the attack.
During the rebuilding process, new backup systems have been created, more updated programs have been installed and other improved security steps have been taken.

Damages were covered through the Wood County school system’s insurance policy through the state Board of Risk and Insurance Management.
Click to expand...

guest · Jan 13, 2020

Essex Police
Companies given advice after ransomware attack
January 2, 2020
https://www.essex.police.uk/news/es...mpanies-given-advice-after-ransomware-attack/

We are reminding companies in Essex to ensure staff are careful while checking their emails following a ransomware attack.

We received a report from a company in Hatfield Peverel on Saturday 11 December that they had been targeted in an attack, which restricted the company’s access to their servers.
The attack is only made possible if a link or an attachment is opened or clicked.
We believe it is a new strain of ransomware that is not picked up on most common anti-virus programmes used – meaning people should be vigilant with emails.

“By taking simple steps, there are many ways you can deter fraudsters.
“Make sure you have reliable security systems in place, remind staff to take five and check the authenticity of emails and links.
Click to expand...

guest · Jan 13, 2020

Nemty Ransomware to Start Leaking Non-Paying Victim's Data
January 13, 2020
https://www.bleepingcomputer.com/ne...are-to-start-leaking-non-paying-victims-data/

The Nemty Ransomware has outlined plans to create a blog that will be used to publish stolen data for ransomware victims who refuse to pay the ransom.

The theory behind this is that companies may be more apt to pay a ransom if it costs less than the possible fines, data breach notification costs, loss of trade and business secrets, tarnishing of brand image, and potential lawsuits for the disclosing of personal data.
To facilitate this publishing of stolen data, the Maze operators have created a web site that they use to publish information about their non-paying victims and links to the leaked data.
Nemty plans on creating a leaked data site
In the Nemty Ransomware affiliate panel, the ransomware developers have a news feed where they post their plans, bug fixes, and upcoming changes coming to their ransomware-as-a-service.

If remains to see if this new extortion method is paying off for the ransomware actors, but one thing is for sure, we will continue to see more threat actors adopting this new tactic.
Click to expand...

guest · Jan 14, 2020

Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices
January 14, 2020
https://www.bleepingcomputer.com/ne...-uses-wake-on-lan-to-encrypt-offline-devices/

The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them.

According to a recent analysis of the Ryuk Ransomware by SentinelLab's Vitali Kremez, when the malware is executed it will spawn subprocesses with the argument '8 LAN'.
If the ARP entry is part of any of those networks, Ryuk will send a Wake-on-Lan (WoL) packet to the device's MAC address to have it power up. This WoL request comes in the form of a 'magic packet' containing 'FF FF FF FF FF FF FF FF'.
If the WoL request was successful, Ryuk will then attempt to mount the remote device's C$ administrative share.

To mitigate this new feature, administrators should only allow Wake-on-Lan packets from administrative devices and workstations.
Click to expand...

guest · Jan 14, 2020

mood said: ↑

Panama-Buena Vista Union School District hit with ransomware attack
January 10, 2020
https://www.turnto23.com/news/local...on-school-district-hit-with-ransomware-attack
Click to expand...

Panama Buena Vista School District working with FBI and DHS following cyber attack
January 14, 2020
https://www.turnto23.com/news/local...rking-with-fbi-and-dhs-following-cyber-attack

The Panama-Buena Vista School District said they are working closely with the Federal Bureau of Investigation and Department of Homeland Security following a ransomware attack last Friday.

On Jan. 10, the district was hit with a cyber ransomware attack that caused a technology and phone outage at multiple schools. The district sent a message update to parents and staff on Tuesday saying ongoing investigations into this attack "show no indications that any personally identifying information relating to students or staff was compromised."
Click to expand...

guest · Jan 14, 2020

Baltimore Ransomware Attack Inspires State Legislation
January 14, 2020
https://www.marylandmatters.org/2020/01/14/baltimore-ransomware-attack-inspires-state-legislation/

In the wake of a crippling ransomware attack that froze government computers in Baltimore City last year, a Maryland lawmaker hopes to give prosecutors more tools to fight cyber attacks on municipalities and other institutions.
The legislation, Senate Bill 30, would make it a crime to possess ransomware with the intent to use it.

At a Senate Judicial Proceedings Committee hearing on Tuesday, lawmakers from both parties expressed support for the measure, as did the association that represents Maryland prosecutors.

“Schools, hospitals and even state’s attorneys are targets, and we need to stem the tide of aggression,” she said.
But Ricardo A. Flores, head of government relations for the Maryland Office of the Public Defender, said the measure isn’t needed because the law already makes ransomware a crime.
“This bill is really just a possessory offense where no actual damage has to actually occur,” he added.
Click to expand...

guest · Jan 15, 2020

New 5ss5c Ransomware Likely Readied to Replace Satan
January 15, 2020
https://www.securityweek.com/new-5ss5c-ransomware-likely-readied-replace-satan

According to malware researcher/analyst Bart Blaze, the actor has been working on this new product since at least November 2019. It is thought to be a work in progress because of the presence of a second spreader module within the code, named poc.exe. "This suggest they may be experimenting (poc often is an acronym for proof of concept)," comments Blaze.

There are several clues within 5ss5c linking the ransomware to Satan. Satan had been regularly developed and updated with new functionalities and techniques -- but this process stopped around the summer of 2019. The appearance of 5ss5c in November is likely to be related.
Like Satan, 5ss5c has an exclusion list of files it does not encrypt. This is slightly expanded.
Click to expand...

guest · Jan 15, 2020

Ako Ransomware Uses Spam to Infect Its Victims
January 15, 2020
https://www.bleepingcomputer.com/news/security/ako-ransomware-uses-spam-to-infect-its-victims/

It has been discovered that the network-targeting Ako ransomware is being distributed through malicious spam attachments that pretend to be a requested agreement.
Last week we reported on the Ako Ransomware [...] Since then, the ransomware identification site ID-Ransomware has seen an increasing amount of victims.

David Pickett, a Senior Cybersecurity Analyst at AppRiver, reached out to BleepingComputer yesterday to tell us that his company saw the Ako ransomware being distributed through spam email.
As spam is being used to spread the Ako Ransomware, everyone must be is trained on how to properly identify malicious email and not open any attachments without first confirming who and why they were sent.
Click to expand...

guest · Jan 16, 2020

Alarming Trend: More Ransomware Gangs Exfiltrating Data
Criminals Increasingly Leak Stolen Data to Force Bitcoin Payoff
January 16, 2020
https://www.databreachtoday.com/alarming-trend-more-ransomware-gangs-exfiltrating-data-a-13612

As if ransomware wasn't already bad enough, more ransomware gangs are now exfiltrating data from victims before leaving systems crypto-locked. Seeking greater leverage to force victims to accede to their ransom demand, attackers are threatening to leak stolen data and then following through.
First, they leak chunks of data before leaking much more - or everything they took - in an attempt to teach future victims a lesson.

This "new, worrying trend" in ransomware - as Raj Samani, chief scientist at McAfee, calls it - has arisen quickly. It means that besides dealing with a ransomware attack, victims must also contend with a data breach, including their legal notification obligations.
Click to expand...

Maze Leads the Way
In late October 2019, however, the Maze ransomware gang dumped almost 700 MB of data that it had stolen from Allied Universal, a California-based security services firm.
Sodinokibi and Nemty Follow
Last month, the operators of Sodinokibi - aka REvil and Sodin - said they would follow Maze's example and help affiliates leak exfiltrated data from victims that refused to pay.
Exfiltrated Data Used to Blackmail Individuals
Some gangs are also using stolen data to target not just organizations but individuals.
"Whether the 'steal then encrypt' business model proves to be more profitable than traditional encryption-only attacks remains to be seen," Emsisoft's Callow says.
Click to expand...

Coveware believes that ransomware gangs' data-dumping strategy is doomed to fail, for two reasons.

First, once the data has exited the building, the smart move is to unleash the corporate attorneys and have them notify regulators, since the data will have already been exposed to malicious actors. In other words, it's a data breach. As Coveware notes: "It's not the crime, but the coverup" that causes real trouble.

"The negative press from the breach can only become worse if the negative press includes a coverup," it says. "This being said, we don't expect all victims to self-disclose. Some will choose to pay and mitigate potential brand damage."
Second, attackers' data-leaking threats and follow-through attempts to shame companies into paying may backfire. "Shame can evoke anger and obstinance as a response, not obedience and control as the attackers hope," Coveware says.
Click to expand...

guest · Jan 16, 2020

mood said: ↑

Ransomware attack hits Contra Costa library system
Few details initially available on possible data compromise
January 3, 2020
https://www.eastbaytimes.com/2020/01/03/ransomware-attack-hits-contra-costa-library-system/
Click to expand...

Contra Costa library system working its way back from ransomware attack
January 16, 2020
https://www.mercurynews.com/2020/01...m-reporting-progress-after-ransomware-attack/

Two weeks after a ransomware attack, the Contra Costa County Library System says it’s making progress in restoring some services, such as public WiFi and printing.

Brooke Converse, spokeswoman for the library system, said public WiFi and printing services are being restored at the rate of about two branches a day in the 26-branch system. An update posted Monday on the library system’s website says services have been restored at the Antioch, Bay Point, Brentwood, Concord, Orinda, Pittsburg and San Pablo branches.
IT experts are monitoring the computer system and working to prevent future attacks, she said.
Click to expand...

guest · Jan 17, 2020

Town of Colonie got hacked; looks to avoid paying ransomware demand of about $400,000
January 17, 2020
https://www.spotlightnews.com/news/...oid-paying-ransomware-demand-of-about-400000/

The town’s computer system was hacked, and the cyber extortionists are asking for about $400,000 in Bitcoin cryptocurrency to unlock it.
But, said Supervisor Paula Mahan, the town is operating on a backup system that is allowing day-to-day operations to continue.

“We have all of our data and our backup system is working as it should be working,” she said. “We have an integrated team working on things, and as of right now it appears we have done everything properly and the process is going well so we are going to let them finish up their analysis and we will go from there.”
Until the team finishes its analysis it is impossible to determine where the ransomware originated, and even then it may be difficult to pinpoint.

The team is still at Colonie Town Hall working on unlocking the main system, or the town could be forced to abandon the existing system and rebuild like the City of Albany.
Click to expand...

guest · Jan 17, 2020

The Week in Ransomware - January 17th 2020 - Never Ends
January 17, 2020
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-17th-2020-never-ends/

Data exfiltration is still the big thing this week, with the Sodinokibi Ransomware publishing stolen files of one of their victims for the first time and Nemty planning on leaking stolen files as well.

In addition we reported on how Ryuk now uses the Wake-on-Lan feature to power on computers so that can be encrypted. Finally, a new version of the Satan Ransomware was released that utilizes Mimikatz and Eternalblue, which is not commonly seen in ransomware samples.
Other than, it has been mostly new variants of existing ransomware and new ransomware families being released. [...]
Click to expand...

guest · Jan 18, 2020

mood said: ↑

Emsisoft released a free decryption tool for Paradise ransomware
October 30, 2019
Click to expand...

Bitdefender
Paradise Ransomware decryption tool
January 16, 2020
https://labs.bitdefender.com/2020/01/paradise-ransomware-decryption-tool/

We’re happy to announce a new decryptor for Paradise Ransomware.

Paradise Ransomware, initially spotted in 2017, has been aggressively marketed as a service to interested affiliates. After infection, it checks whether the keyboard language is set to Russian, Kazakh, Belarus or Ukrainian and, if so, exits without encrypting. Otherwise, it encrypts files and deletes shadow copies to prevent the user from restoring them.

The tool can also be executed silently via a command line. If you need to automate deployment of the tool inside a large network, you might want to use this feature.  
Click to expand...

Download Paradise Ransomware decryption tool: https://labs.bitdefender.com/wp-content/uploads/downloads/paradise-ransomware-decryptor/

guest · Jan 18, 2020

New Jersey Synagogue Suffers Sodinokibi Ransomware Attack
January 18, 2020
https://www.bleepingcomputer.com/ne...nagogue-suffers-sodinokibi-ransomware-attack/

Temple Har Shalom in Warren, New Jersey had their network breached by the actors behind the Sodinokibi Ransomware who encrypted numerous computers on the network.

"The encryption affected all of our server-based files and electronic data. We have a mechanical back up for those files and data, but the back-up was encrypted as well. Certain computers were affected in full. Others were unaffected and remain functional," the email from Temple Har Shalom stated.
A source familiar with the matter told BleepingComputer that Sodinokibi was demanding close to $500,000 ransom to receive a decryptor for their network.

As Sodinokibi is known to steal files before encrypting them, they may have gained access to the personal data of congregants.
The synagogue states that this data may include a congregant's name, address, and email address, but they do not believe the attackers had access to their financial information.

"Beyond names, addresses and e-mail addresses of congregants, because of the way we segregate our files, we do not believe that confidential personal membership information (such as financial information) was accessed," the email stated. "Nonetheless, as we note above, be particularly mindful of phishing scams."
Click to expand...

guest · Jan 20, 2020

Oman’s largest insurance company hit by ransomware attack
January 19, 2020
https://www.thearabianstories.com/2...nce-company-in-oman-hit-by-ransomware-attack/

Oman United Insurance Co SAOG, one among the largest insurers in the country has disclosed a “ransomware attack” on the company’s data centre early this month.

In a filing to the Capital Market Authority (CMO) on Thursday, the company revealed that its systems were attacked on January 1st and said it has “lost some data relating to the period from 10/12/2019 to 1/1/2020”, yet no “financial impact on the company’s results.”

“The main server was hit and some data was also infected and encrypted. The company lost some data relating to the period from December 10, 2019 to January 1, 2020.
As a result, the company suspended online operations for one day (Thursday, January 2, 2020). “However, the server is operating and we recovered the lost data,” the statement from the company said.
Click to expand...

guest · Jan 20, 2020

FTCode Ransomware Now Steals Saved Login Credentials
January 20, 2020
https://www.bleepingcomputer.com/news/security/ftcode-ransomware-now-steals-saved-login-credentials/

FTCode ransomware victims now have one more thing to worry about with the malware having been upgraded to also steal saved user credentials from email clients and web browsers.

Being fully developed in PowerShell allows it to encrypt its targets' devices without having to download additional components, while also making it very easy for its developers to add new functionality.
The 'new and improved' FTCode ransomware
The newly added info stealer functionality allows FTCode to harvest and exfiltrate the stored credentials before encrypting its victims' files.
This capability was not available in previous variants as confirmed in a report published by researchers with the Zscaler ThreatLabZ team.
Click to expand...

An FTCode Decryptor for those who can capture the encryption keys while having their computers encrypted is available from Certego.
Click to expand...

Zscaler: FTCODE Ransomware — New Version Includes Stealing Capabilities

guest · Jan 21, 2020

BitPyLock Ransomware Now Threatens to Publish Stolen Data
January 21, 2020
https://www.bleepingcomputer.com/ne...somware-now-threatens-to-publish-stolen-data/

A new ransomware called BitPyLock has quickly gone from targeting individual workstations to trying to compromise networks and stealing files before encrypting devices.
BitPyLock was first discovered by MalwareHunterTeam on January 9th, 2020 and has since seen a trickle of new victims daily.
The BitPyLock Ransomware
Based on our analysis, when first launched, BitPyLock will attempt to terminate any processes that contain the following strings. This is done to terminate security software and close files being used by backup software, web server daemons, virtual machines, and databases so that they can be encrypted.

Strangely, the sample that we saw had a static bitcoin address in the executable, which means every victim would have the same bitcoin address and thus it could make it impossible to determine who paid the ransom.
Click to expand...

guest · Jan 21, 2020

600 Computers Taken Down After Florida Library Cyberattack
January 21, 2020
https://www.bleepingcomputer.com/ne...taken-down-after-florida-library-cyberattack/

600 staff and public access computers were taken down at Volusia County Public Library (VCPL) branches from Daytona Beach, Florida, following a cyberattack that started around 7 AM on January 9.

"Approximately 50 computers are back online, enabling library staff to perform patron business, such as checking books in and out, and making reservations."
While the official statement issued by the library does not mention ransomware being used to encrypt the 600 computers that went offline after the incident, there's a high chance that this was the case and all the signs are there to point to the devices getting encrypted.
"The county is conducting an investigation and more information will be available at a later date," VCPL staff also said.

BleepingComputer asked VCPL to confirm that ransomware was what caused the computers to go down but did not hear back at the time of publication.
Click to expand...

guest · Jan 22, 2020

mood said: ↑

Watertown school system hit by hackers
November 6, 2019
https://www.wfsb.com/news/watertown...cle_d1387b76-00d1-11ea-9195-936280ea9249.html
Click to expand...

Watertown computer system almost repaired after ransomware attack
January 21, 2020
https://www.rep-am.com/local/news-l...stem-almost-repaired-after-ransomware-attack/

The school district’s computer system is almost back up to full speed, Superintendent Rydell Harrison reported, with technicians installing new preventative software as they repair the effects of a ransomware attack.

Teachers have their computers back, and “we’re very close to being back to normal,” Harrison said. “For what needs to happens on a day-to-day basis for teaching and learning, we’re back to normal.”

“A lot of the changes we needed to make to ensure that we’re protected going forward, we’ve been making those updates throughout the process of piecing things back together,” he said.
Neither district officials nor law enforcement agents have divulged whether there was a ransom demand made or paid.
District officials are preparing for preliminary budget presentations to be made in the coming weeks.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches