Ransomware and Recent Variants

ronjor · Oct 19, 2018

City Pays $2,000 in Computer Ransomware Attack

By Associated Press on October 19, 2018
A Connecticut city has paid $2,000 to restore access to its computer system after a ransomware attack.
West Haven officials said Thursday they paid the money to anonymous attackers through the digital currency bitcoin to unlock 23 servers and restore access to city data.
Click to expand...

guest · Oct 19, 2018

The Week in Ransomware - October 19th 2018 - GandCrab, Birbware, and More
October 19, 2018
https://www.bleepingcomputer.com/ne...october-19th-2018-gandcrab-birbware-and-more/

It has been another slow week, with mostly new variants of existing ransomware being released. The biggest news is that the GandCrab Ransomware developers have decided to release the decryption keys for Syrian victims. Unfortunately, there is no decryptor available that will work with all versions of the keys that were released, so victims will have to wait for an AV company to release a working decryptor. [...]
Click to expand...

guest · Oct 20, 2018

Indiana National Guard server hit by ransomware attack
October 19, 2018
https://www.wthr.com/article/indiana-national-guard-server-hit-ransomware-attack

A state computer server with information about Indiana National Guard personnel was hit by a ransomware attack.

The National Guard announced the confirmed attack in a release Thursday, saying the non-military state server contained personal identifying information of civilian and military Guard personnel.

The Guard and Indiana State Police say the type of attack that hit the server will deny access to the rightful owners of the server, but "usually does not compromise the contents of the server." The Guard does not believe they were specifically targeted in the attack.
Click to expand...

guest · Oct 21, 2018

Kraken Cryptor Ransomware Connecting to BleepingComputer During Encryption
October 21, 2018
https://www.bleepingcomputer.com/ne...ecting-to-bleepingcomputer-during-encryption/

Over the weekend, the Kraken Cryptor Ransomware released version 2.0.6, which now connects to BleepingComputer during different stages of their encryption process. It is not known what they are trying to achieve by doing this, but it does provide BleepingComputer with insight into the amount of victims being infected by this ransomware.

This new version was first spotted by exploit kit experts nao_sec and Kafeine who saw it being distributed via malvertising and the RIG exploit kit.

In this new version a variable is created that contains the string "https://2no.co/2SVJa5" as shown below. This URL belongs to the IPlogger.com service that allows users to create shortened URLs and track statistics of how many times it has been used. [...]
Click to expand...

guest · Oct 22, 2018

The latest variant of Satan ransomware is spreading in the wild
October 22, 2018
https://blog.360totalsecurity.com/e...of-satan-ransomware-is-spreading-in-the-wild/

Recently, 360 Security Center captured the latest variant of Satan ransomware and monitored that it has begun to spread in the wild. The new version of Satan has been updated to v4.2. After the attack is launched successfully, the file will be encrypted and the file suffix will be “sicck”.

The new version of Satan ransomware discovered this time is still targeted at Windows servers. When Satan successfully hacked into the server, it used the server as a zombie server and then scanned and tried to invade other computers on the network that had vulnerabilities. Moreover, the new version of “Satan” also uses two new system vulnerabilities to spread, so that users can’t prevent it. [...] cve-2018-2894 [...]
Click to expand...

guest · Oct 25, 2018

New FilesLocker Ransomware Offered as a Ransomware as a Service
October 25, 2018
https://www.bleepingcomputer.com/ne...somware-offered-as-a-ransomware-as-a-service/

A new ransomware called FilesLocker is being distributed as a Ransomware as a Service, or RaaS, that targets Chinese and English speaking victims.

This ransomware was first spotted by MalwareHunterTeam who posted about it on Twitter. At the time, it looked like your standard small little C# ransomware with little or no distribution. It turns out, though, that this ransomware is being offered as a RaaS where affiliates can sign up and earn commissions.

The RaaS claims to have numerous features you would expect such as tracking, customization, strong encryption, and the clearing of shadow volume copies.

[...] this is not a very sophisticated RaaS compared to what we have seen with other families, but it is effective. If the program recruits enough affiliates who know how to spread malware, it could be as devastating to a victim as any other ransomware out there.
Click to expand...

guest · Oct 26, 2018

The Week in Ransomware - October 26th 2018 - Decryptors, RaaS, and More
October 26, 2018
https://www.bleepingcomputer.com/ne...e-october-26th-2018-decryptors-raas-and-more/

We have had quite a bit of interesting news this week regarding ransomware. First we had the Kraken Cryptor deciding to connect to BleepingComputer.com during different stages of the encryption process, then we had a decryptor released by Bitdefender for GandCrab v1, v4, and v5, and finally a new FilesLocker rasnomware as a service.

Unfortunately, today the GandCrab developers released a new variant that breaks the current Bitdefender decryptor.

Other than that, its mostly been releases of new variants of existing ransomware such as Dharma and Matrix. [...]
Click to expand...

Minimalist · Oct 30, 2018

CommonRansom Ransomware Demands RDP Access to Decrypt Files

A new ransomware called CommonRansom was discovered that has a very bizarre request. In order to decrypt a computer after a payment is made, they require the victim to open up Remote Desktop Services on the affected computer and send them admin credentials in order to decrypt the victim's files.
Click to expand...

https://www.bleepingcomputer.com/ne...nsomware-demands-rdp-access-to-decrypt-files/

guest · Oct 31, 2018

SamSam ransomware group has hit 67 organizations in 2018, researchers say
October 30, 2018
https://www.cyberscoop.com/samsam-ransomware-hit-67-organizations-2018-researchers-say/

The group behind the disruptive SamSam ransomware has attacked 67 different organizations in 2018, nearly a quarter of which were health care organizations, new research shows.

On Tuesday, cybersecurity company Symantec released data showing that of the 67 organizations targeted by the SamSam group in the last 10 months, more than 80 percent are based in the United States.

“SamSam continues to pose a grave threat to organizations in the U.S.,” a Symantec blog post states. “The group is skilled and resourceful, capable of using tactics and tools more commonly seen in espionage attacks.”
Click to expand...

guest · Oct 31, 2018

Crypto-Locking Kraken Ransomware Looms Larger
October 31, 2018
https://www.inforisktoday.com/crypto-locking-kraken-ransomware-looms-larger-a-11652

A slick ransomware-as-a-service operation called Kraken has begun leveraging a new exploit kit to help it score fresh victims, and unfortunately, that combination may prove challenging to defend against, according to new research released by analysts at McAfee and Recorded Future.

Many of the insights into the ransomware come from one of its customer service representatives, who goes by the nickname "ThisWasKraken." That individual runs Kraken Cryptor as an affiliate program, which enables others to license fresh versions of the ransomware that have been designed to avoid anti-virus software.

"Kraken's goal is to encourage more wannabe cybercriminals to purchase this RaaS and conduct their own attacks, ultimately leading to more money in the developers' pockets," writes Gary Davis, chief consumer security evangelist for McAfee, in a blog post.
Click to expand...

ronjor · Nov 2, 2018

Australian Shipbuilder Hacked, Refuses to Pay Ransom

Jeremy Kirk (jeremy_kirk) November 2, 2018
Austal Says Material Is Neither Sensitive Nor Classified
Click to expand...

guest · Nov 2, 2018

New Ransomware using DiskCryptor With Custom Ransom Message
November 2, 2018
https://www.bleepingcomputer.com/ne...using-diskcryptor-with-custom-ransom-message/

A new ransomware has been discovered that installs DiskCryptor on the infected computer and reboots your computer. On reboot, victims will be greeted with a custom ransom note that explains that their disk has been encrypted and how to pay the ransom.

DiskCryptor is a encryption program that encrypts the whole disk and then prompts the user to enter a password on reboot. This password prompt occurs before Windows even starts and a user must enter the password to decrypt the drive and start the computer's normal boot process.

Discovered by MalwareHunterTeam, this ransomware is being run manually or called by another script as it requires an argument to be passed to the program, which is used as the password for DiskCryptor. It is also possible that the attackers are hacking into Remote Desktop Services and installing the ransomware manually.
Click to expand...

guest · Nov 2, 2018

The Week in Ransomware - November 2nd 2018 - RaaS, DiskCryptor, & More
November 2, 2018
https://www.bleepingcomputer.com/ne...-november-2nd-2018-raas-diskcryptor-and-more/

This week we saw a new RaaS called CommonRansom, a new DiskCryptor variant, and numerous Dharma variant released. Otherwise, it has been a fairly light news week for ransomware. [...]
Click to expand...

Minimalist · Nov 7, 2018

Healthcare Targeted by 37 Percent of All Ransomware Attacks in Q3 2018

During the third quarter of 2018 ransomware attacks were at an all-time high and the ransoms asked from organizations to decrypt the locked files were also on the rise according to a report from Beazley Breach Response (BBR) Services.
Click to expand...

https://news.softpedia.com/news/hea...ll-ransomware-attacks-in-q3-2018-523661.shtml

Minimalist · Nov 8, 2018

Ransomware-as-a-Service Program Offers Affiliates Up to 75 Percent of Revenue to Spread Infection

A ransomware-as-a-service program called FilesLocker is offering affiliates commissions of up to 75 percent on all revenue stolen from victims if they can drive enough traffic.
Click to expand...

https://securityintelligence.com/ne...to-75-percent-of-revenue-to-spread-infection/

Minimalist · Nov 8, 2018

Dharma Ransomware Hits Altus Baytown Hospital's Systems

Altus Baytown Hospital (ABH) was hit by a ransomware attack on September 3, 2018, with a lot of documents containing patient info being encrypted and the attackers requesting a ransom to unlock the hospital's data.
Click to expand...

https://news.softpedia.com/news/dharma-ransomware-hits-altus-baytown-hospital-s-systems-523692.shtml

guest · Nov 9, 2018

The Week in Ransomware - November 9th 2018 - Mostly Dharma Variants
November 9, 2018
https://www.bleepingcomputer.com/ne...are-november-9th-2018-mostly-dharma-variants/

It was a very slow week for ransomware news. For the most part, it was mostly new Dharma ransomware variants and a few smaller variants being released. Stay vigilant, though, as a slow week does not mean ransomware is not a threat.

Make sure you have all of your updates installed, RDP secured, and be careful with unknown attachments. [...]
Click to expand...

guest · Nov 14, 2018

Ransomware attacks see huge rise compared to 2017
November 14, 2018
https://www.itproportal.com/news/ransomware-attacks-see-huge-rise-compared-to-2017/

Malware and its younger sibling ransomware are on the rise, security experts are warning. According to new global figures from cyber security company SonicWall, malware has seen a 44 per cent jump, compared to the same period last year.

More than 300,000 new attack variants have been spotted during the period between January and October this year, which means 1,095 new attacks every day. More than 50,000 of these attack variants have never been seen before.

SonicWall says its web apps experienced 108 per cent more attacks this year, amounting to a total of 93,816 threats. Encrypted threats, 'the hardest for the average web user to detect', were up 62 per cent.
Click to expand...

guest · Nov 14, 2018

Media Prima hit by ransomware attack — sources
November 13, 2018
http://www.theedgemarkets.com/article/media-prima-hit-ransomware-attack-—-sources

Media Prima Bhd has been hit by a ransomware attack since last Thursday, preventing the use of its in-house emails, according to sources.

“The whole Media Prima group’s computer systems have been breached and infected with ransomware over the last four days. The attackers demanded 1,000 bitcoins from Media Prima in the ransomware attack,” said one source.

[...] This translates into US$6.45 million.

It is not immediately known whether Media Prima’s data has been breached, and whether the media group would be suffering financial losses due to the ransomware attack.
Although ransomware has locked its system and made it inaccessible until a payment is made, it is understood that Media Prima has decided not to pay the ransom.
Click to expand...

guest · Nov 15, 2018

500 Percent Increase in macOS/iOS Ransomware Attacks During 1H 2018
MSPs report 5+ attacks on their client base on average
November 15, 2018
https://news.softpedia.com/news/500...ansomware-attacks-during-1h-2018-523810.shtml

According to Datto's "State of the Channel Ransomware Report" survey which comprises stats gathered from more than 2,400 MSPs from all around the globe, 79% of all questioned MSPs said that ransomware is still a massive threat to small-to-mid-sized businesses (SMBs).

"From Q2 2016 - Q2 2018, 79% of MSPs report ransomware attacks against customers. In the first 6 months of 2018 alone, 55% report ransomware attacks against clients," says Datto's survey. "92% of MSPs predict the number of ransomware attacks will continue at current, or worse, rates."
Phishing emails are the leading ransomware distribution method
Moreover, even though almost 90% of all MSPs that were part of Datto's survey say that they are currently on high alert when it comes to the seriousness of the ransomware threat, only 36% of their SMB clients mirror their concern.

The most worrying trend observed by the MSPs which took part in Datto's study was that ransomware infections affecting cloud infrastructure had seen a continuous rise since the previous year.
Click to expand...

ronjor · Nov 16, 2018

SamSam and GandCrab Illustrate Evolution of Ransomware

By Kevin Townsend on November 16, 2018
2018 has seen a major divergence in the operation of ransomware: targeted versus ransomware as a service (RaaS). Two particular malware families have dominated each branch: SamSam (targeted) and GandCrab (RaaS). Targeted seeks high ransoms from relatively few victims, while RaaS seeks relatively small ransoms from a large number of victims.
Click to expand...

itman · Nov 16, 2018

ronjor said: ↑

mSam and GandCrab Illustrate Evolution of Ransomware
Click to expand...

The following brings to mind "be careful who you pick a fight with."

Then followed a strange tit-for-tat between the GandCrab developer and South Korean firm AhnLab. AhnLab released a vaccine for GandCrab. GandCrab retaliated -- supposedly within hours -- by releasing an alleged zero-day against AhnLab's anti-virus product. "Their killswitch has became useless in only few hours," the GandCrab developer told Bleeping Computer. His own exploit, however, would be a "reputation hole for ahnlab for years."
Click to expand...

Also time for bleepingcomputer.com to install some current NSA tools to track to the source these perpetrators when they boast of their exploits.

guest · Nov 16, 2018

The Week in Ransomware - November 16th 2018 - Mostly Small Variants Released
November 16, 2018
https://www.bleepingcomputer.com/ne...ber-16th-2018-mostly-small-variants-released/

This week we had some new variants of common ransomware infections such as Dharma and Matrix. Otherwise, it has predominantly been small variants that were either created as a test or have minimal distribution. [...]
Click to expand...

guest · Nov 21, 2018

City of Valdez, Alaska admits to paying off ransomware infection
November 21, 2018
https://www.zdnet.com/article/city-of-valdez-alaska-admits-to-paying-off-ransomware-infection/

Officials from the city of Valdez, Alaska have admitted last week to paying $26,623.97 to hackers after the city's IT network was crippled by a ransomware infection in July.

"[...] a specialty cyber-incident response and digital forensics firm [...] anonymously contacted the attackers on the City's behalf to investigate and possibly negotiate ransom terms."
City officials said that despite the ransomware having infected 27 servers and 170 computers, the third-party firm managed to negotiate the ransom payment down to 4 bitcoin, worth $26,623.97, at the time.

Valdez officials say that next year, in 2019, they plan to replace and rebuild all the IT systems that have been infected by the ransomware, just to be sure there's no residual backdoor or hidden malware that hackers may use to reinfect the city's IT network again.
Click to expand...

guest · Nov 23, 2018

The Week in Ransomware - November 23rd 2018 - STOP, Dharma, and More
November 23, 2018
https://www.bleepingcomputer.com/ne...ware-november-23rd-2018-stop-dharma-and-more/

This week has mostly been releases of new variants of existing ransomware. Not much of interest other than the developer of the DelphiMorix ransomware trolling ransomware researchers by utilizing their aliases as the extensions for encrypted files.

Otherwise, stay careful out there. Ransomware is increasingly becoming more targeted so make sure that your backups are verified, RDP is secure, you do not open attachments from those you don't know, and keep installing those security updates. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

itman Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

itman Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches