Russia hit by new wave of ransomware spam

Minimalist · Jan 28, 2019

January 2019 has seen a dramatic uptick in detections of malicious JavaScript email attachments, an attack vector that mostly lay dormant throughout 2018. Among the “New Year edition” of malicious spam campaigns relying on this vector, we have detected a new wave of Russian-language spam that distributes ransomware known as Shade or Troldesh, and detected by ESET as Win32/Filecoder.Shade.

The campaign appears to be a follow-up to a malicious spam campaign that started distributing the Shade ransomware in October 2018.
Click to expand...

https://www.welivesecurity.com/2019/01/28/russia-hit-new-wave-ransomware-spam/

guest · Feb 19, 2019

The Long Run of Shade Ransomware
February 19, 2019
https://blog.yoroi.company/research/the-long-run-of-shade-ransomware/

Between January and February, a new, intense, ransomware campaign have been observed by many security firms. It spreads Shade/Treshold variants, one of the most dangerous threats in the cyber crime scenario, known since its massive infection into the Russian panorama back in 2015, its expansion has been tracked by several CSIRTs and CERTs all across the world.

The chosen infection vector is the email one, usual and effective.
This file acts as downloader in the infection chain, using a series of hard-coded server addresses, It heavily rely on obfuscation and encryption to avoid the antimalware detection.

[...] the attackers didn’t change too much their modus operandi and infrastructure, the same wallet ID has been maintained over the year, propagation techniques and patterns are quite constant too.
Click to expand...

guest · Mar 6, 2019

Spotlight on Troldesh ransomware, aka ‘Shade’
March 6, 2019
https://blog.malwarebytes.com/threat-analysis/2019/03/spotlight-troldesh-ransomware-aka-shade/

Despite the decline in the number of ransomware infections over the last year, there are several ransomware families that are still active. Ransom.Troldesh, aka Shade, is one of them. According to our product telemetry, Shade has experienced a sharp increase in detections from Q4 2018 to Q1 2019.
Infection vector
Troldesh, which has been around since 2014, is typically spread by malspam—specifically malicious email attachments. The attachments are usually zip files presented to the receiver as something he “has to” open quickly.
The origin of Troldesh is believed to be Russian because its ransom notes are written in both Russian and English.

Even though AES 256 is a strong encryption algorithm, there are free decryption tools available for some of the Troldesh variants. You can find out more about these decryption tools at NoMoreRansom.org (look under “Shade” in the alphabetical list).
Click to expand...

guest · May 23, 2019

Shade Ransomware Expands to U.S. Targets
Coming to America: The Shade ransomware, which has historically targeted Russian victims, was recently spotted expanding its sights
May 23, 2019
https://threatpost.com/shade-ransomware-expands-us/145020/

“In fact, our research shows that the top five countries affected by Shade ransomware are not Russia or nations of the former Soviet Union; they are the United States, Japan, India, Thailand, and Canada,” said Brad Duncan, researcher with Palo Alto Networks’ Unit 42 group in a Wednesday analysis.
Ransomware Campaigns
The Shade ransomware is spread through malspam emails. In a recent February 2019 campaign for instance, the emails touted a link to an archive, archive attachment or attached PDF with a link to an archive, disguised as an invoice or bill.
These links and attachments lead to a Javascript or other script-based file that is designed to retrieve the Shade executable file.
New Targets
Researchers found that the U.S. saw the most number of attempts to inject systems with Shade (outpacing Japan, India and Thailand).

“The top country with Shade ransomware infection attempts among our customer base was the United States,” according to Palo Alto. “The vast majority of these URLs hosting Shade ransomware executables were reported from customer devices outside of Russia and Russian-language countries.”
Click to expand...

Unit 42: Shade Ransomware Hits High-Tech, Wholesale, Education Sectors in U.S, Japan, India, Thailand, Canada

guest · Jun 25, 2019

Ransomware strain Troldesh spikes again – Avast tracks new attacks
June 25, 2019
https://blog.avast.com/ransomware-strain-troldesh-spikes

This week the ransomware known as Troldesh, which made headlines early this year, spiked again in Russia, Mexico, and the U.S.

Troldesh (aka Shade) was spread by phishing emails last winter, and is reportedly now being spread via social networks and other messaging platforms, where posts point to malicious links.
Avast researcher Jakub Křoustek was able to track a spike Monday (June 24) predominantly in Russia and Mexico, but with smaller spikes in the U.K. and Germany.

“We see a spike in the number of its attacks that is probably more to do with Troldesh operators trying to push this strain harder and more effectively than any kind of significant code update,” Křoustek said.
Click to expand...

guest · Aug 12, 2019

Troldesh Ransomware Dropper
August 12, 2019
https://blog.sucuri.net/2019/08/troldesh-ransomware-dropper.html

Over the past few weeks, we’ve seen an increase in Troldesh ransomware using compromised websites as intermediary malware distributors.

The malware often uses a PHP file that acts as a delivery tool for downloading the host malware dropper [...] This type of infected URL is usually spread through malicious emails or through services like social media.
Malicious “JSC Airline” JScript File
Once a victim clicks the URL and loads it, a JScript file downloads to the victim’s computer. This malware targets Windows OS, which uses JScript
This malicious file is the host-based malware dropper. When executed (e.g victim loads the JScript file), it begins the process of infecting the victim’s computer by prepping the download of the actual ransomware executable file

This campaign demonstrates how bad actors leverage compromised websites to host malicious downloads and distribute ransomware.
Click to expand...

guest · Nov 19, 2019

Shade Ransomware Is the Most Actively Distributed Malware via Email
November 19, 2019
https://www.bleepingcomputer.com/ne...-most-actively-distributed-malware-via-email/

During the first half of 2019, the Shade Ransomware (also known as Troldesh) was the most actively distributed malware via malicious email phishing campaigns according to Singapore-based Group-IB security outfit.

Based on their results, ransomware has seen a huge boost in usage during malicious campaigns when compared to malware activity from 2018 dominated by backdoors and banking Trojans, with attacks detected during this year even surpassing the ransomware boom from 2017.

"In 2018, the major vector for financial losses was via bank Trojans and backdoors, whereas the first half of 2019 showed a rapid increase in ransomware usage," the report says.
Shade Ransomware is a strain sold or rented on various crimeware markets and a ransomware known for using constantly changing Tor command-and-control (C2) servers that make it harder to block.
Click to expand...

Log in or Sign up

Russia hit by new wave of ransomware spam

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Russia hit by new wave of ransomware spam

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches