Ransomware and Recent Variants

Minimalist · Dec 1, 2018

Moscow's New Cable Car System Infected with Ransomware the Day After it Opens

Moscow recently opened its first cable-car service and promised free rides for the first month. Unfortunately, only days after after the service was made available, attackers reportedly hacked into the cable car systems and infected them with ransomware.

With eager passengers waiting to take their free ride, police officers were explaining that the cable car was shut down due to technical reasons according to a report from the TheMoscowTimes.
Click to expand...

https://www.bleepingcomputer.com/ne...ected-with-ransomware-the-day-after-it-opens/

guest · Dec 1, 2018

The Week in Ransomware - November 30th 2018 - Indictments, Sanctions, & More
November 30, 2018
https://www.bleepingcomputer.com/ne...ber-30th-2018-indictments-sanctions-and-more/

Been a pretty interesting week when it comes to ransomware. First, we had two Iranians who were indicted by the U.S. government for their involvement in the SamSam operation. Then, the U.S. government, for the first time, attributed two Iran-based individuals for their involvement in converting ransomware payments to fiat currency on behalf of the SamSam group. As these individuals were added to the U.S. sanction list, any company that pay a ransomware payment to them will essentially be violating sanctions.

In other news, we had a bunch of Scarab and Dharma Ransomware variants released as well as a variety of other smaller ransomware variants. [...]
Click to expand...

FanJ · Dec 2, 2018

Fox-IT has an article in Dutch about SamSam ransomware in The Netherlands. ( 2 Dec 2018 )
Sorry, it is at their Dutch blog and not at the international one, and I don't see an English version at the moment.
https://www.fox-it.com/nl/insights/blogs/blog/nieuwe-gijzelsoftware-treft-ook-nederland/

Nederlandse bedrijven zijn de afgelopen maanden getroffen door een nieuwe vorm van gijzelsoftware. Die wordt SamSam genoemd. Het is niet bekend hoeveel financiële schade de software vooralsnog heeft aangericht in Nederland.
Click to expand...

ronjor · Dec 4, 2018

SamSam Ransomware

Original release date: December 03, 2018
Technical Details
NCCIC recommends organizations review the following SamSam Malware Analysis Reports. The reports represent four SamSam malware variants. This is not an exhaustive list.

MAR-10219351.r1.v2 – SamSam1
MAR-10166283.r1.v1 – SamSam2
MAR-10158513.r1.v1 – SamSam3
MAR-10164494.r1.v1 – SamSam4
Click to expand...

guest · Dec 4, 2018

New ransomware demands payment over WeChat Pay in China
December 4, 2018
https://www.cnet.com/news/new-ransomware-demands-payment-via-wechat-pay-in-china/

[...] a new one has struck mobile-centric China and it's asking for ransom through one of the country's most popular methods of payment.
Over 20,000 computers have fallen victim to an unnamed ransomware that is demanding payment via WeChat Pay, local media reported today, adding that the number is still growing.

Files on the affected devices are encrypted by the ransomware. It also steals passwords to popular sites including shopping platforms Taobao, Tmall and JD.com, as well as digital wallet Alipay, Baidu Cloud, internet company NetEase's 163 email service and Tencent's instant messaging platform QQ.

To regain access to the files, users are asked to scan a WeChat QR code that appears in a pop-up window and pay 110 yuan (about $16) in ransom.
Click to expand...

guest · Dec 6, 2018

mood said: ↑

New ransomware demands payment over WeChat Pay in China
December 4, 2018
https://www.cnet.com/news/new-ransomware-demands-payment-via-wechat-pay-in-china/
Click to expand...

A decryptor is available:

https://www.bleepingcomputer.com/ne...est-dev-behind-unnamed1989-wechat-ransomware/
[...]
Decryptors available for the UNNAMED1989 Ransomware
Thankfully, the UNNAMED1989 Ransomware only utilized XOR encryption, so decryptors have been released by Tencent and the Velvet Security Team.
Using these decryptors, victims can get their files back for free.
Click to expand...

guest · Dec 7, 2018

The Week in Ransomware - December 7th 2018 - WeChat Ransomware, Scammers, & More
December 7, 2018
https://www.bleepingcomputer.com/ne...7th-2018-wechat-ransomware-scammers-and-more/

This was a pretty interesting week for ransomware. An attacker out of China managed to infected over 100,000 victims with a poorly-written ransomware that asked victims to pay the ransom via WeChat. Thankfully, the ransomware was easily decrypted by numerous companies and the developer was arrested a few days later.

Other big news is research from Check Point where showed how an "Ransomware Decryption" company stated that they could decrypt numerous ransomware families, but just tacked on a fee and paid the ransomware developers instead. [...]
Click to expand...

Minimalist · Dec 8, 2018

Those annoying sextortion scams are redirecting users to ransomware now

This past week, users in the United States have been bombarded by an email spam campaign that pushed a double-whammy of a sextortion attempt combined with a possible ransomware infection.
Click to expand...

https://www.zdnet.com/article/those...cams-are-redirecting-users-to-ransomware-now/

guest · Dec 10, 2018

City of North Bend hit with ransomware
December 10, 2018
https://www.scmagazine.com/home/sec...y-workers-from-their-computers-and-databases/

“One weekend morning a few weeks back all of our servers and things locked up, and we received a ransomware note that said for $50,000 in Bitcoin these people would provide us with the code to unlock our computer systems,” North Bend City Administrator Terence O’Connor told The World.

Fortunately the city’s IT systems were backed up and officials were able to avoid the high ransom demanded by the criminals responsible for the attack.

O’Connor added that the attack appeared to be a more sophisticated ransomware where there are two keys needed to unlock your system with one planted in the system and the other is held by the culprit.
[...] The city was insured and ended up having to pay around $5,000 [...]
Click to expand...

guest · Dec 11, 2018

Satan Ransomware Variant Exploits 10 Server-Side Flaws
December 10, 2018
https://www.darkreading.com/threat-...-exploits-10-server-side-flaws/d/d-id/1333448

A new version of ransomware that first surfaced about two years ago is garnering attention for its ability to spread via as many as ten different vulnerabilities in Windows and Linux server platforms.
"Lucky," as the new malware is called, is a variant of Satan, a data encryption tool that first became available via a ransomware-as-a-service offering in January 2017

Security vendor NSFocus spotted the variant on systems belonging to some of its financial services customers in late November, and described it as likely to cause extensive infections worldwide.
NSFocus identified the ten vulnerabilities that Lucky uses to propagate itself [...]

Lucky is an example of how attackers have evolved ransomware tools over the past two- to three years. Instead of targeting OS vulnerabilities—such as Windows SMB protocol—on desktop and other end-user systems, attackers have pivoted to attacking servers instead, Giannakidis notes.
Click to expand...

guest · Dec 13, 2018

Atlanta CIO says city has moved more systems to cloud since ransomware attack
December 12, 2018
https://statescoop.com/atlanta-cio-...ore-systems-to-cloud-since-ransomware-attack/

The recently installed chief information officer of Atlanta says the city has responded to a March ransomware incident that crippled thousands of government computers and dozens of municipal services by moving more of its infrastructure to cloud services.

He also says the city is using its experience to offer advice to other governments hit by ransomware.
“What we focused on more recently is getting back to operational basics,” he says. “We are now trying to establish a blueprint for other cities and agencies around the country. How do you recover in a way that doesn’t affect operations?”
Click to expand...

guest · Dec 14, 2018

The Week in Ransomware - December 14th 2018 - Slow Week
December 14, 2018
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-14th-2018-slow-week/

It is a pretty slow week as we lead up to the holidays. Historically, ransomware tends to slow down during this time as people go away for vacation and businesses take more time off.

For the most part, we had a few new variants of existing ransomware such as Dharma, Scarab, and even a CryptoMix variant popped up. Otherwise, not much news to report. [...]
Click to expand...

guest · Dec 21, 2018

The Week in Ransomware - December 21st 2018 - No More Ransomware
December 21, 2018
https://www.bleepingcomputer.com/ne...omware-december-21st-2018-no-more-ransomware/

Slow week with ransomware news as we lead up into the holidays. Mostly small variants that won't get much distribution or releases of new variants of older ransomware.

For me at least, the biggest news this week is that BleepingComputer has now been added as an associate partner of the No More Ransom project. [...]
Click to expand...

guest · Dec 26, 2018

JungleSec Ransomware Infects Victims Through IPMI Remote Consoles
December 26, 2018
https://www.bleepingcomputer.com/ne...infects-victims-through-ipmi-remote-consoles/

A ransomware called JungleSec is infecting victims through unsecured IPMI (Intelligent Platform Management Interface) cards since early November.

IPMI is a management interface built into server motherboards or installed as an add-on card that allow administrators to remotely manage the computer, power on and off the computer, get system information, and get access to a KVM that gives you remote console access.
Installing JungleSec through IPMI
In one case, the IPMI interface was using the default manufacturer passwords. The other victim stated that the Admin user was disabled, but the attacker was still able to gain access through possible vulnerabilities.

Once the user gained access to the servers, which in both of these cases were Linux, the attackers would reboot the computer into single user mode in order to gain root access. Once in single user mode, they downloaded and compiled the ccrypt encryption program. [...]
Click to expand...

Minimalist · Jan 2, 2019

How to Decrypt the FilesLocker Ransomware with FilesLockerDecrypter

FilesLocker is a Ransomware as a Service (RaaS) where the developer offers the ransomware executable to "affiliates". These affiliates will then distribute the ransomware and split the revenue from ransom payments with the ransomware developer.

On December 29th, an unknown user released the master RSA decryption key for FilesLocker v1 and v2. This allowed Michael Gillespie to release a decryptor for files encrypted by the FilesLocker Ransomware that have the .[fileslocker@pm.me] extension appended to file names.
Click to expand...

https://www.bleepingcomputer.com/ra...slocker-ransomware-with-fileslockerdecrypter/

guest · Jan 4, 2019

The Week in Ransomware - January 4th 2019 - IPMI, FilesLocker, and More
January 4, 2019
https://www.bleepingcomputer.com/ne...e-january-4th-2019-ipmi-fileslocker-and-more/

For the past two weeks, we have seen a lot of new variants, decryptors, and Ryuk ransomware outbreaks. Of particular interest is the JungleSec ransomware, which has been hacking into servers via IPMI in order to install the ransomware.

We have also seen a resurgence of Paradise Ransomware, MMM Reborn, and the release of the master decryption key for the older variants of FilesLocker.
Click to expand...

guest · Jan 8, 2019

Ransomware MongoLock Immediately Deletes Files, Formats Backup Drives
January 8, 2019
https://www.trendmicro.com/vinfo/us...mediately-deletes-files-formats-backup-drives

We have been following a new wave of MongoLock ransomware attacks that immediately deletes files upon infection instead of encrypting it, and further scans for other available folders and drives for file deletion.
In the wild since December 2018, the ransomware demands a payment of 0.1 bitcoin from victims within 24 hours to retrieve the files allegedly saved in the cybercriminals’ servers

The ransomware scans and then deletes files found in the Documents, Desktop, Recent, Favorites, Music, Videos, and Recycle Bin folders, and formats the available backup drives. According to the ransom note, copies of the deleted files are uploaded to a URL using an encrypted HTTPS protocol, and we traced the email and command and control (C&C) server hosted in a ToR network.
File deletion continues after the infected computer is offline, making the files unrecoverable.
Click to expand...

guest · Jan 9, 2019

CryptoMix Ransomware Exploits Sick Children to Coerce Payments
January 9, 2019
https://www.bleepingcomputer.com/ne...re-exploits-sick-children-to-coerce-payments/

CryptoMix pretending to be a children's charity is not new, but this latest iteration is taking it to the next level of depravity by including stories and information taken from legitimate crowdfunding pages for sick children.

This tactic was reported in the BleepingComputer forums close to a year ago by a CryptoMix victim was able to track down the crowdfunding page for the child whose information was being used. At the time, it appeared to be one time tactic by an affiliate, but according to ransomware assistance firm Coveware, this tactic continues to this day..

Earlier this week Bill Siegel, the CEO of Coveware, contacted me to let us know about this tactic and how the ransomware developers continue the charade throughout the entire payment process, which is illustrated in a blog post on their site.
Click to expand...

Minimalist · Jan 10, 2019

What happens when the cops get hit with malware, too?

When they are on the receiving end of a ransomware attack, one of the first things the victims can do is call the police -- but what happens when the cops themselves falls victim to ransomware?
Click to expand...

https://www.zdnet.com/article/what-happens-when-the-cops-get-hit-with-malware-too/

Minimalist · Jan 11, 2019

Ryuk ransomware shows Russian criminal group is going big or going home

A criminal hacking group suspected of operating out of Russia has shifted tactics in recent months from wire fraud to targeting big organizations for ransomware payouts, according to new research.

The change in tactics is exemplified by the infamous Ryuk ransomware, which cybersecurity company CrowdStrike said Thursday is being used by a subset of the Russian group to rake in $3.7 million since August.
Click to expand...

https://www.cyberscoop.com/ryuk-ransomware-shows-russian-criminal-group-is-going-big-or-going-home/

Minimalist · Jan 11, 2019

Was North Korea Wrongly Accused of Ransomware Attacks?

The Ryuk ransomware that emerged in summer of 2018 is likely not the work of state-sponsored North Korean hackers, security researchers now say.

First detailed in August 2018, the malware was tied to the Hermes ransomware, which was previously associated with Lazarus, a group of hackers notorious for a large number of high-profile attacks, including the attack against the Far Eastern International Bank (FEIB) in Taiwan.

According to new research from FireEye, CrowdStrike, and McAfee, while Ryuk indeed features snippets of code previously observed in Hermes, the code similarities are insufficient to conclude that North Korea is indeed responsible for the Ryuk attacks.
Click to expand...

https://www.securityweek.com/was-north-korea-wrongly-accused-ransomware-attacks

Minimalist · Jan 11, 2019

Del Rio City Hall Forced to Use Paper After Ransomware Attack

The City Hall of Del Rio, Texas was hit by a ransomware attack on Thursday, which led to multiple computers on the network being turned off and disconnected from the Internet to contain and analyze the malware.

Victoria Vargas Public Relations Manager for Del Rio's City Hall told BleepingComputer that around 30 to 45 computers were turned off after detecting the attack during the morning of January 10 and that the ransom note contained a phone number to be used to contact the attackers for instructions on how to pay the ransom.
Click to expand...

https://www.bleepingcomputer.com/ne...-forced-to-use-paper-after-ransomware-attack/

Minimalist · Jan 12, 2019

New ransomware rakes in $4 million by adopting a “big game hunting” strategy

A recently discovered ransomware group has netted almost $4 million since August, in large part by following a path that’s uncommon in its industry—selectively installing the malicious encryption software on previously infected targets with deep pockets. The method differs from the usual one of indiscriminately infecting all possible victims. That’s the take of two analyses published Thursday, one by security firm CrowdStrike and the other by competitor FireEye.
Click to expand...

https://arstechnica.com/information...lion-by-adopting-a-big-game-hunting-strategy/

guest · Jan 12, 2019

The Week in Ransomware - January 11th 2019 - Access-as-a-Service
January 12, 2019
https://www.bleepingcomputer.com/ne...omware-january-11th-2019-access-as-a-service/

For the most part it has been a slow this week in terms of new ransomware variants being released. On the other hand, there has been quite a bit of interesting information that was released about Ryuk.

Researchers from FireEye and CrowdStrike released reports this week that explain how Ryuk partnered with TrickBot in an access-as-a-service in order to gain access to infected networks. Other reports also came out that lead researchers to believe that the attackers behind Ryuk are Russian, rather than North Korean. [...]
Click to expand...

Minimalist · Jan 14, 2019

Free government decryption keys save ransomware victims millions

Government authorities in the US have saved “millions of dollars” for private companies hit by ransomware attacks by sharing decryption keys for free.

John Mullen - partner at law firm Mullen Coughlin, which specialises in handling security breaches - told last week’s Consumer Electronics Show (CES) that the government had helped out on cases his firm handled.
Click to expand...

https://www.itnews.com.au/news/free...-keys-save-ransomware-victims-millions-517851

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

FanJ Updates Team

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

FanJ Updates Team

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Useful Searches