Ransomware and Recent Variants

guest · Sep 2, 2018

Barack Obama's Blackmail Virus Ransomware Only Encrypts .EXE Files
September 2, 2018
https://www.bleepingcomputer.com/ne...ail-virus-ransomware-only-encrypts-exe-files/

Every once in a while you come across a really strange malware and such is the case with a new ransomware that only encrypts .EXE files on a computer. It then displays a screen with a picture of President Obama that asks for a "tip" to decrypt the files.

First tweeted by MalwareHunterTeam, this ransomware has the bizarre title of "Barack Obama's Everlasting Blue Blackmail Virus" as shown by the file properties below. [...]

It will then scan the computer for .exe files and encrypt them. When encrypting files, it will target all .EXE files, even those that are located under the Windows folder.
As part of the encryption process, this ransomware will also modify the Registry keys associated with .exe files so that they use a new icon and run the virus every time someone launches an executable.
Click to expand...

guest · Sep 8, 2018

The Week in Ransomware - September 7th 2018 - Obama, Matrix, and More
September 7, 2018
https://www.bleepingcomputer.com/ne...are-september-7th-2018-obama-matrix-and-more/

It has been a quiet week with just small variants and new variants of existing ones such as Matrix. As much as we would like to see ransomware die off altogether, it is hear to stay.

Dharma is still going strong, targeting businesses via open Remote Desktop services. Therefore, make sure that you have any computers running remote desktop services behind a firewall and only accessible via a VPN. [...]
Click to expand...

guest · Sep 10, 2018

A Closer Look at the Locky Poser, PyLocky Ransomware
September 10, 2018
https://blog.trendmicro.com/trendla...r-look-at-the-locky-poser-pylocky-ransomware/

[...] PyLocky (detected by Trend Micro as RANSOM_PYLOCKY.A), imitate established ransomware families and ride on their notoriety.

In late July and throughout August, we observed waves of spam email delivering the PyLocky ransomware. Although it tries to pass off as Locky in its ransom note, PyLocker is unrelated to Locky. PyLocky is written in Python, a popular scripting language; and packaged with PyInstaller, a tool used to package Python-based programs as standalone executables.

Ransomware written in Python isn’t new [...] Through the combined use of Inno Setup Installer (an open-source script-based installer) and PyInstaller, it posed a challenge to static analysis methods, including machine learning-based solutions
Infection Chain
On August 2, we detected a spam run distributing PyLocky to French businesses, luring them with socially engineered subject lines such as those related to invoices. The email entices the user to click a link, which redirects users to a malicious URL containing PyLocky. [...]
Click to expand...

guest · Sep 11, 2018

Mongo Lock Attack Ransoming Deleted MongoDB Databases
September 11, 2018
https://www.bleepingcomputer.com/ne...k-attack-ransoming-deleted-mongodb-databases/

An attack called Mongo Lock is targeting remotely accessible and unprotected MongoDB databases, wiping them, and then demanding a ransom in order to get the contents back.

These hijacks work by attackers scanning the Internet or using services such as Shodan.io to search for unprotected MongoDB servers. Once connected, the attackers may export the databases, delete them, and then create a ransom note explaining how to get the databases back.

According to security researcher Bob Diachenko who discovered the new Mongo Lock campaign, the attackers will connect to an unprotected database and delete it. In its place, the attackers will leave a new database called "Warning" with a collection inside it named "Readme".
The Readme collection will contain a ransom note that explains that the database has been encrypted and that the victims need to pay them a ransom to get it back.
Click to expand...

itman · Sep 12, 2018

A Closer Look at the Locky Poser, PyLocky Ransomware
Click to expand...

This is one nasty bugger:

1.

What makes PyLocky stand out from the crowd compared to other Python malware is anti-machine learning capability. It also uses the open-source script-based Inno Setup Installer and can pose a real challenge to static analysis methods, the security researchers say.
Click to expand...

2.

The ransomware abuses Windows Management Instrumentation (WMI) to check the properties of the affected system. It also features anti-sandbox capabilities, sleeping for 999,999 seconds (around 11.5 days) if the affected system has a total visible memory size of less than 4GB.
Click to expand...

https://www.securityweek.com/new-python-based-ransomware-poses-locky

guest · Sep 14, 2018

Kraken Cryptor Ransomware Masquerading as SuperAntiSpyware Security Program
September 14, 2018
https://www.bleepingcomputer.com/ne...erading-as-superantispyware-security-program/

The Kraken Cryptor Ransomware is a newer ransomware that was released in August 2018. A new version, called Kraken Cryptor 1.5, was recently released that is masquerading as the legitimate SuperAntiSpyware anti-malware program in order to trick users into installing it.

What makes it worse, though, is that somehow the attackers were able to gain access to the superantispyware.com site and distribute the ransomware from there.
Kraken Cryptor Ransomware 1.5 masquerading as SuperAntiSpyware
MalwareHunterTeam, who has been tracking Kraken Cryptor since it has been released, discovered the new variant this morning. When looking at its entry on VirusTotal, he noticed that VirusTotal was reporting that the Kraken Cryptor installer had been distributed directly from superantispyware.com.

It is important to note that the SUPERAntiSpyware.exe executable was not compromised and continued to install the legitimate version of SuperAntiSpyware. So users who installed SuperAntiSpyware via the normal links were not affected.
Click to expand...

itman · Sep 14, 2018

mood said: ↑

Kraken Cryptor Ransomware Masquerading as SuperAntiSpyware Security Program
Click to expand...

Does anyone still use SuperAntiSpyware anymore?

guest · Sep 14, 2018

Fallout Exploit Kit Pushing the SAVEfiles Ransomware
September 14, 2018
https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-pushing-the-savefiles-ransomware/

Last week the Fallout Exploit kit was distributing the GandCrab ransomware. This week, it has started to distribute a new ransomware called SAVEfiles, for lack of a better name, through malvertising campaigns.

This ransomware was first discovered by Michael Gillespie, but it was not known how it was being distributed. Today, exploit kit expert Kafeine, discovered it being distributed in malvertising campaigns where IP addresses in Japan, France, and other locations have been targeted.

[...] the malvertisement will cause the visitor to go through a stream of redirects until they eventually get to a site hosting the Fallout Exploit kit.

The exploit kit will then automatically download and install the SAVEfiles ransomware onto the victims computer. The connection to http://xxxart.pp.ua/1/get.php is the ransomware connecting back to it's Command & Control server to receive an encryption key.
Click to expand...

guest · Sep 14, 2018

The Week in Ransomware - September 14th 2018 - Kraken, Dharma, & Matrix
September 14, 2018
https://www.bleepingcomputer.com/ne...september-14th-2018-kraken-dharma-and-matrix/

Was a quiet week for new variants, but a bunch of long-running ransomware infections released new variants this week. We had a few from Scarab, a new Dharma variant, and a new Matrix ransomware variant.

While ransomware is slowing down, it is not going away. So stay vigilant, make sure you perform backups, and get remote desktop off of public ip addresses! [...]
Click to expand...

guest · Sep 15, 2018

New Brrr Dharma Ransomware Variant Released
September 15, 2018
https://www.bleepingcomputer.com/news/security/new-brrr-dharma-ransomware-variant-released/

A new variant of the Dharma Ransomware was released this week that appends the .brrr extension to encrypted files.

Unfortunately, there is no way to decrypt files infected with the Dharma Brrr Ransomware variant for free.
Distributed through hacked Remote Desktop Services
The Dharma Ransomware family, including this Brrr variant, is manually installed by attackers who hack into Remote Desktop Services connected directly to the Internet. These attackers will scan the Internet for computers running RDP, usually on TCP port 3389, and then attempt to brute force the password for the computer.
Click to expand...

guest · Sep 21, 2018

New ransomware can turn your computer into a hacker's tool
Virobot infects devices and then forces them to spread the malware via email.
September 21, 2018
https://www.cnet.com/news/new-ransomware-can-turn-your-computer-into-a-hackers-tool/

This new malware isn't letting any part of an infected computer go to waste.

The Virobot ransomware -- spotted on Sept. 17 by Trend Micro researchers -- doesn't just lock up infected computers, it also enlists them as part of its massive botnet.

After Virobot encrypts a computer, it sends a ransom note demanding about $522 in bitcoin. While it's locked up the computer, the malware is also using the device's Microsoft Outlook to send spam email to the person's contact list. The email contains a copy of Virobot in the hopes of spreading the malware.

Trend Micro's researchers said that Virobot isn't able to encrypt any files at the moment because its control server was taken down.
Click to expand...

guest · Sep 21, 2018

Scotland's Arran Brewery Slammed by Dharma Bip Ransomware
Ransomware Crypto-Locked via Domain Controller, Complicating Restoration
September 21, 2018
https://www.inforisktoday.com/scotlands-arran-brewery-slammed-by-dharma-bip-ransomware-a-11537

A Scottish brewery was locked out of its computer systems after refusing to pay attackers a two bitcoin ransom worth more than $13,000.

Arran Brewery, based on the Isle of Arran - a Scottish island located off the west coast of the country - lost three months' worth of sales data after the attack, which it believes traces to fake job application emails that carried malware-laden attachments, the BBC first reported.
Crypto-Locked: Recent Backups
Unfortunately, some of the crypto-locked systems included the company's backups, including 90 days' worth of sales data.

The brewery hopes that one day it will be able to restore the lost sales data. "We've kept a backup of all the encrypted files as Kaspersky Lab has issued a decryption tool for earlier releases of Dharma, so we are hoping for an update so we can decrypt the files," Michaluk says.
Click to expand...

EASTER · Sep 21, 2018

The brewery hopes that one day it will be able to restore the lost sales data. "We've kept a backup of all the encrypted files as Kaspersky Lab has issued a decryption tool for earlier releases of Dharma, so we are hoping for an update so we can decrypt the files," Michaluk says.
Click to expand...

Well be interesting to see if they can get that digital data back again. Pls keep us updated. They for good reason must be scrambling to salvage what they can if not all.

guest · Sep 21, 2018

Gamma, Bkp, & Monro Dharma Ransomware Variants Released in One Week
September 21, 2018
https://www.bleepingcomputer.com/ne...rma-ransomware-variants-released-in-one-week/

This week we have seen three new Dharma Ransomware variants released that append either the .Gamma, .Bkp, & .Monro extensions to encrypted files.

It is highly unusual for this ransomware family to release so many variants released in a short period of time. Typically, one variant used for a month, if not more, and then a new variant is released. Instead, we saw three new variants released in the same week.

All three variants were discovered by security researcher Jakub Kroustek, who posted the samples on Twitter. [...]
Click to expand...

guest · Sep 22, 2018

The Week in Ransomware - September 21st 2018 - Beer, Airports, & Dharma
September 21, 2018
https://www.bleepingcomputer.com/ne...september-21st-2018-beer-airports-and-dharma/

This has been a busy week. We had a brewery hit, an airport's flight and arrival time displays taken out, and Dharma deciding to release three different variants in one week. The NSA CodeBreaker Challenge was also kicked off today and it has a ransomware theme this year. [...]
Click to expand...

Minimalist · Sep 23, 2018

Brewery became victim of targeted ransomware attack via job vacancy ad

A targeted ransomware attack involved hackers taking a job vacancy posted on a company's website and posting it on international recruitment sites; one of the resumes included a Dharma Bip ransomware payload.
Click to expand...

https://www.csoonline.com/article/3...ted-ransomware-attack-via-job-vacancy-ad.html

guest · Sep 26, 2018

Businesses in Arkansas Hit with Ransomware
September 26, 2018
https://www.infosecurity-magazine.com/news/busineses-in-arkansas-hit-with/

According to local news provider KARK, local businesses in Conway, Arkansas, have been hit with a ransomware attack. Some of the businesses have reportedly lost thousands of dollars.

Companies impacted by the attack don’t want to go public, but KARK is reporting that multiple files have been encrypted by hackers who are demanding a ransom in exchange for the returned files.

One of Fletcher’s customers, whom he declined to identify, was down for a couple days after falling victim to an attack despite efforts to recover documents from its four backups.

"Another week, another ransomware attack hitting the headlines,” said Caroline Seymour, director of product marketing at Zerto. “This time it is a geographically focused series of attacks in Conway, Arkansas."
Click to expand...

guest · Sep 28, 2018

The Week in Ransomware - September 28th 2018 - RDP and gandCrab
September 28, 2018
https://www.bleepingcomputer.com/ne...somware-september-28th-2018-rdp-and-gandcrab/

During this week, we did not see a large amount of smaller variants released compared to what we have historically seen. This is because ransomware has moved towards large network-wide breaches by variants such SamSam, BitPaymer, and Dharma over publicly exposed remote desktop services.

Due to the rise in these types of attacks, the Internet Crime Complaint Center (IC3) has released a security alert about attacks targeting exposed remote desktop services. [...]
Click to expand...

Minimalist · Oct 4, 2018

Viro Botnet Uses Spamming and Keylogging Capabilities to Spread Ransomware

Security researchers observed a new attack campaign in which the Viro botnet infects devices with ransomware and then uses those compromised machines to infect more victims.
Click to expand...

https://securityintelligence.com/ne...keylogging-capabilities-to-spread-ransomware/

Minimalist · Oct 4, 2018

Fallout Exploit Kit Now Installing the Kraken Cryptor Ransomware

The Fallout Exploit has been distributing the GandCrab Ransomware for the past few weeks, but has now switched its payload to the Kraken Cryptor Ransomware.
Click to expand...

https://www.bleepingcomputer.com/ne...now-installing-the-kraken-cryptor-ransomware/

guest · Oct 5, 2018

The Week in Ransomware - October 5th 2018 - Restaurant Shutdowns & Exploit Kits
October 5, 2018
https://www.bleepingcomputer.com/ne...h-2018-restaurant-shutdowns-and-exploit-kits/

Very very quiet week this. Not much new ransomware to report and only released of well known variants like Matrix, Unlock92, and Dharma ransomware infections. The biggest news was the shut down of numerous restaurants that are part of the Recipe Unlimited group and the Kraken Cryptor ransomware being distributed by the Fallout Exploit kit. [...]
Click to expand...

guest · Oct 11, 2018

Qihoo 360’s precise analysis of ransomware for September
October 11, 2018
https://blog.360totalsecurity.com/en/qihoo-360s-precise-analysis-of-ransomware-for-september/

The statistics on the infection data of this year’s ransom virus found that the overall data declined, but from August to September, the infected users began to have an upward trend. The main reason for the increase in feedback in September was a concentrated outbreak of GandCrab ransomware at the end of September.

However, by comparing the August infected system with the September infected system, the server system attacked in September rose from 22% to 24%. Servers are being attacked more and more, the main reason is that during long-running servers, if there are no obvious problems, administrators rarely check the server status.

The two most affected families of ransom virus are still the Crysis family and the GlobeImposter family. Among them, the Crysis family added suffixes BRRR, BTC, BGTX, MONRO, and BKP, but the most common ones are COMBO and BIP that have appeared earlier.
[...] From the figure showing the distribution of the infected system, Windows 2003 accounted for the highest proportion of the infected server system version, followed by Windows 2008.
Click to expand...

guest · Oct 12, 2018

The Week in Ransomware - October 12th 2018 - NotPetya, GandCrab, and More
October 12, 2018
https://www.bleepingcomputer.com/ne...october-12th-2018-notpetya-gandcrab-and-more/

Lots of Scarab, Matrix, and Dharma variants this week as well as some good writeups on the GandCrab ransomware. Also of interest is the report published by ESET that ties NotPetya and Industroyer to the TeleBots Group. [...]
Click to expand...

guest · Oct 12, 2018

Madison County computers were hacked with ransomware virus
October 11, 2018
https://www.eastidahonews.com/2018/10/madison-county-computers-were-hacked-with-ransomware-virus/

A ransomware computer virus infecting computers in Madison County offices is limiting employee access to computer files and functions.

Madison County Clerk Kim Muir tells EastIdahNews.com a ransomware virus infected the system Sunday night but wasn’t discovered until Monday while employees were gone for Columbus Day. [...] Muir says they have no intention of paying the ransom.

Many of the files that were encrypted have since been restored. As of Thursday morning, Muir says they still do not have access to email, but hope to have it restored by Thursday afternoon.
Click to expand...

guest · Oct 15, 2018

Ransomware hits computer networks of North Carolina water utility
October 15, 2018
https://www.cyberscoop.com/ransomware-hits-onwasa-computer-network-north-carolina-water-utility/

A North Carolina water utility has been infected by ransomware in a breach the company says has forced customer-service functions offline and will require it to rebuild its computing infrastructure.

Jacksonville, North Carolina-based Onslow Water and Sewer Authority (ONWASA) said in a statement that it was hit by the Ryuk ransomware virus in the middle of the night on Saturday. That followed the spread of the “polymorphic” EMOTET malware through the utility’s networks beginning Oct. 4, according to the statement, in a pair of infections that overwhelmed IT personnel

“We experienced a catastrophic loss inside our computer network,” ONWASA CEO Jeffrey Hudson said in a video posted to the utility’s Facebook page.

Customer information wasn’t compromised, and the incident does not affect the safety of the water supply, the utility emphasized. Customer information is stored offsite in a vendor’s cloud computing system, the statement said.
Click to expand...

Statement (PDF): https://www.onwasa.com/DocumentCenter/View/3701/Scan-from-2018-10-15-08_08_13-A

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches