Ransomware and Recent Variants

guest · Sep 17, 2019

HDDCryptor/Mamba Ransomware Returns to Encrypt Disk and Network Files
September 17, 2019
https://www.trendmicro.com/vinfo/us...are-returns-to-encrypt-disk-and-network-files

A new variant of HDDCryptor aka Mamba (detected by Trend Micro as Ransom.Win64.MCRYPT.SMB) was uncovered recently. The ransomware has been known to use DiskCryptor to encrypt disk and network files and overwrite the Master Boot Record (MBR). Iterations of the ransomware were previously seen in attacks against the San Francisco Municipal Transport Agency (SFMTA) in 2016 and a number of victims in Brazil and Saudi Arabia in 2017.
Old tricks by HDDCryptor/Mamba still at play
The new HDDCryptor variant was found with a modified DiskCryptor component. However, the ransomware’s core capabilities are still similar to those of previous iterations.
It abuses a combination of freeware, open-source, and commercially available software to scramble disks and mounted Server Message Block (SMB) drives. It also locks the victim machine’s hard drive by overwriting the MBR with a modified bootloader.

The modified DiskCryptor executable library component of Ransom.Win64.MCRYPT.SMB also has the same routine and anomaly as those of the 2016 variant.
Click to expand...

guest · Sep 17, 2019

TFlower Ransomware - The Latest Attack Targeting Businesses
September 17, 2019
https://www.bleepingcomputer.com/ne...mware-the-latest-attack-targeting-businesses/

The latest ransomware targeting corporate environments is called TFlower and is being installed on networks after attackers hack into exposed Remote Desktop services.
Gaining access via RDP
TFlower is being installed in a corporate network through exposed Remote Desktop services that are being hacked by attackers.
Once the attackers gain access to the machine, they will infect the local machine or may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc.

It is not known how much the ransom amounts are at this time.
TFlower is still being researched, so it is not known at this time if there are any weaknesses in the encryption that could allow a user to get their files back for free.
Click to expand...

guest · Sep 18, 2019

New ransomware strain uses ‘overkill’ encryption to lock down your PC
The new Nemty malware may have ties to GandCrab and Sodinokibi
September 18, 2019
https://www.zdnet.com/article/this-ransomware-uses-overkill-encryption-to-lock-down-your-pc/

A new form of ransomware that has been spotted in the wild uses what researchers call "overkill" levels of encryption to hijack infected systems.
This week, FortiGuard Labs said the new variant, known as Nemty, was recently shared as a sample by a Twitter bot that posts PasteBin links to malware code.

Due to the discovery of a key which gives the ransomware's operators the opportunity to decrypt any file regardless of public and private key setups, it is possible the malware is being offered as ransomware-as-a-service (RaaS). Researchers have previously outlined the similarity between GandCrab and Sodinokibi code.
While there is a function to send encrypted configuration information from a target machine to the ransomware's command-and-control (C2) server, at the moment, the IP address intended to be used for the C2 is just a loopback address.

"It is possible that they simply have not configured an operational server to receive the data yet," the researchers say.
Click to expand...

Fortinet: Nemty Ransomware 1.0: A Threat in its Early Stage

guest · Sep 19, 2019

Ransomware attack against Ava, Mo. School District fails, prompts strengthening of network
September 18, 2019
https://www.ky3.com/content/news/Hackers--560726221.html

Ransom notes mysteriously shot out of printers in the Ava School District, demanding money to get information back.
The district shut down its network as a precaution.

"It could have been a lot worse. We still got compromised. We found some holes," Dial told KY3.
Dr. Dial says Ava uses encrypted data, stores information on off-site servers and has a good backup system, so the district's financial, employee and student information was never threatened.

"We're going to start spoofing our own employees. Our technology department is going to send an email from an unknown address and see if they're opening that, to try and help train them to learn how to keep viruses off our network," Dial told KY3.
Dr. Dial says the district does have a cyber-insurance policy that covers for things like ransomware hacks.
Click to expand...

guest · Sep 19, 2019

mood said: ↑

Ransomware disables Cleveland airport’s email systems, information screens
April 25, 2019
https://www.scmagazine.com/home/sec...d-airports-email-systems-information-screens/
Click to expand...

Cleveland Hopkins International Airport has been target of more cyber attacks, but security upgrades blocked them
September 18, 2019
https://www.cleveland.com/metro/201...tacks-but-security-upgrades-blocked-them.html

Cleveland Hopkins International Airport has spent nearly $2 million on upgrading computer security since a malware attack in April took down message boards in the terminal for about a week.
But the attacks have continued.

Airport Director Robert Kennedy said Wednesday that the airport, much like other government entities, has been a target of an unspecified number of attempted hacks – all of which were foiled.

“Since the malware attack, we’ve been attacked more,” Kennedy told City Council’s Transportation Committee.
Kennedy credited efforts that have bolstered the system for successfully fending off the attacks.
Click to expand...

Minimalist · Sep 20, 2019

Meet Stop Ransomware: The Most Active Ransomware Nobody Talks About

Have you ever heard of the STOP Ransomware? Probably not, as few write about it, most researchers don't cover it, and for the most part it targets consumers through cracked software, adware bundles, and shady sites.
Click to expand...

https://www.bleepingcomputer.com/ne...he-most-active-ransomware-nobody-talks-about/

guest · Sep 20, 2019

Cyber attack that cost Stratford city hall $75K ransom should be wake-up call: Expert
September 20, 2019
https://www.stratfordbeaconherald.c...-than-75000-in-bitcoin-following-cyber-attack

The cyber attack that forced Stratford city hall to pay a hacker $75,000 in Bitcoin shows the local government wasn’t properly protecting itself and should be a wake-up call to other municipalities, an expert says.

City hall officials say they paid 10 Bitcoins – a digital currency used to make online transactions, often on the so-called dark web – after the April 14 cyber attack, which crippled the municipal government’s computer systems.

“In the ideal world, nobody would have to pay one red cent in the wake of a ransomware attack because they will have already secured their data elsewhere,” Levy said.
“The fact Stratford self-compelled to pay means they weren’t backing their data properly, they weren’t testing restores and they were leaving themselves vulnerable and they got caught.”
Levy called these kinds of attacks “the new epidemic” in cyber security.
Click to expand...

guest · Sep 20, 2019

mood said: ↑

Hackers target Wakulla Schools, shut down district-wide emails in ransomware attack
September 10, 2019
https://eu.tallahassee.com/story/ne...s-shuts-down-district-wide-emails/2275809001/
Click to expand...

Wakulla County school board elects to negotiate with ransomware hackers
September 20, 2019
https://www.scmagazine.com/home/sec...-elects-to-negotiate-with-ransomware-hackers/

Wakulla County Schools board members on Wednesday reportedly voted unanimously to negotiate with hackers who infected the Florida-based district’s systems with ransomware.

The district, located in the Tallahassee metropolitan area, first felt the effects of the attack one earlier this month. Emails, bus routing, and library and food service systems have all been impacted, the Wakulla News reported. Altogether, about 40 to 50 computers will likely need to be wiped and reformatted, Superintendent Bobby Pearce told the news source.
It remains unknown how much the extortionists are currently demanding in payment.
8/quote]
Click to expand...

guest · Sep 20, 2019

Hackers hit Travis Central Appraisal District website
September 19, 2019
https://www.bizjournals.com/austin/...rs-hit-travis-central-appraisal-district.html

The Travis Central Appraisal District has been malfunctioning for about a week after it was hit by a cyberattack on Sept. 11.

The agency on Sept. 19 confirmed the attack. Chief Appraiser Marya Crigler said in a statement its computer systems were attacked at 9:30 p.m. on Sept. 11. The attack affected “website property search, phone, email, and Computer Assisted Mass Appraisal systems,” Crigler said.
TCAD's daily operations like appraisal protests were not impacted by the attack, Crigler said, and confidential property owner information was not exposed.

In a separate document posted online, TCAD said the attack was a ransomware virus, which is a type of attack that encrypts and locks files and computer systems, holding them hostage in the hopes of securing a ransom payment. TCAD said it refused to pay the ransom, adding there is no evidence that data was breached during the attack.
Click to expand...

Cyber-Attack- September 19, 2019
(PDF): https://www.traviscad.org/wp-content/uploads/2019/09/MEDIA-STATEMENT_20190918.pdf
Cyber-Attack FAQs
(PDF): https://www.traviscad.org/wp-content/uploads/2019/09/Cyber-Attack-FAQs.pdf

guest · Sep 20, 2019

The Week in Ransomware - September 20th 2019 - Fairly Quiet
September 20, 2019
https://www.bleepingcomputer.com/ne...-ransomware-september-20th-2019-fairly-quiet/

This has been a fairly quiet week with no real big news other than further updates from Nemty, the introduction of TFlower, and another Ordinypt campaign targeting Germany.
Otherwise, it is has been mostly new variants of STOP, Dharma, and new variants that do not get much distribution. [...]
Click to expand...

guest · Sep 21, 2019

mood said: ↑

Nampa School District sees steady progress in cyberattack recovery
August 30, 2019
https://www.idahopress.com/news/loc...cle_cf3cb657-baf6-52cf-87c1-7492deeff5c7.html

Idaho schools under ransomware attack. Will ransomware make America great again? (August 23, 2019)
Click to expand...

Nampa students get new computers month after cyberattack
September 21, 2019
https://lmtribune.com/northwest/nam...cle_7e367e0f-a103-5d26-88f0-770eb836dad1.html

An Idaho school district has distributed computers to students a month after a department-wide cyberattack wiped out the district’s network, officials said.

Nampa School District officials finished giving out re-imaged laptops to middle school students after high school students were equipped with unaffected devices last week, the Idaho Press reported Thursday. The district distributed usable computers to staff members in August.

“Our top priority is to get everything back up and running,” district spokeswoman Kathleen Tuck said.
The district has not been able to determine the source of the attack or how much the recovery will cost, she said.
Click to expand...

guest · Sep 23, 2019

Dharma Ransomware Continues to Evolve
September 23, 2019
https://securityboulevard.com/2019/09/dharma-ransomware-continues-to-evolve/

Since 2016, the Dharma family of ransomware has continued to net its operators ransom after ransom. Its continued effectiveness is due to several factors, from the number of attack vectors used to the ransom amount demanded. The ransomware family is well-known among the InfoSec community but appeared to gain international notoriety when a hospital in Texas suffered an attack that resulted in the encryption of important patient records.
Dharma activity comes in waves, with hackers using newer versions of the malware each time. Hospitals are not the only organizations that have been targeted by hackers; breweries and businesses operating in the maritime industry also have been affected.

For researchers, revealing the threat actors behind Dharma has been almost impossible. Changing attack vectors, continually updating the malware and switching tactics have served the cybercriminals well in continuing their operations. However, with every campaign, researchers have come to uncover a little bit more about the ransomware and, more importantly, how to defend against it.
Click to expand...

guest · Sep 24, 2019

Wolcott school officials provide information on district wide cyber attack
September 23, 2019
https://www.wfsb.com/news/wolcott-s...cle_0aa5ded0-de77-11e9-9525-7341c35e3348.html

For the second time this year, the Wolcott School district is the victim of a cyber-attack, leaving teachers and students unable to use the district’s computer network.

School officials told Channel 3 they are not paying the $10,000 ransom to the hackers in order to retrieve the information.
Superintendent Anthony Gasper addressed the school’s efforts to get their computer network back online. It remains offline since hackers broke into the system.

The district was first hacked in June and then again in September. It is not clear if the attacks came from the same hackers. The district did not pay any money to release the information. Meanwhile, Police Chief Ed Stephens said paying ransom is not the answer.
Click to expand...

guest · Sep 24, 2019

Mobile County School District website down after ransomware attack
September 23, 2019
https://www.al.com/news/mobile/2019...ict-website-down-after-ransomware-attack.html

Experts are weighing in on the ransomware attack that has taken the Mobile County School District website down.

The company that manages the Mobile site, SchoolinSite, had its phones, emails and Help Desk “negatively affected,” according to a Facebook post. The attack began approximately 14 hours ago, and the most recent update on the attack was around 11 a.m. on Monday.

Mobile is not the first school to be affected by attacks in the state. Houston County Schools were forced to move their school start date back due to a cyber attack at the start of this school session. In August, six Alabama schools had already been hit by cyberattacks, according to earlier reporting by AL.com.
Click to expand...

guest · Sep 24, 2019

The top vulnerabilities in enterprise ransomware attacks
September 24, 2019
https://betanews.com/2019/09/24/top-enterprise-ransomware-vulnerabilities/

A new report from vulnerability management company RiskSense looks at the most common vulnerabilities used across multiple families of ransomware that target enterprises and government organizations.

Among its key findings are that almost 65 percent target high-value assets like servers, close to 55 percent have CVSS v2 scores lower than eight, nearly 35 percent are old (from 2015 or earlier), and the vulnerabilities used in WannaCry are still being used today.

"While consumer ransomware targets Windows and Adobe vulnerabilities, enterprise ransomware targets high-value assets like servers, application infrastructure, and collaboration tools, since they contain an organization's critical business data," says Srinivas Mukkamala, CEO of RiskSense.
All of the vulnerabilities analyzed in the dataset either enabled remote code execution (RCE) or privilege escalation (PE). These traits continue to be widely used by attackers and should be considered important attributes for prioritizing patching efforts.
Click to expand...

Risksense: Enterprise Ransomware Hits Where It Hurts

guest · Sep 24, 2019

The Epidemic Analysis of Ransomware in August 2019
September 24, 2019
https://blog.360totalsecurity.com/en/the-epidemic-analysis-of-ransomware-in-august-2019/

Compared with the July data, this month’s anti-ransom service feedback has increased significantly, and the amount of Stop feedback has risen the most. GlobeImposter released a new variant with Simplified Chinese this month. The Sodinokibi attack gang has also started targeted phishing email attacks against Chinese users. Nemty’s new ransomware, which mimics Sodinokibi, began to spread in China.

According to the analysis of the proportion of the ransomware family this month, the Stop family ranked first with 36.83%, followed by the phobos family with 20.08%, and the GlobeImposter family ranked third with 15.44%. [...]
Click to expand...

guest · Sep 24, 2019

Canadian Centre for Cyber Security: TFlower Ransomware Campaign
September 20, 2019
https://cyber.gc.ca/en/alerts/tflower-ransomware-campaign

Purpose
On 30 July 2019 a new variant of ransomware named TFlower was discovered. The Cyber Centre has become aware of this ransomware recently affecting the Canadian public.
Assessment
Initial infection vector for this malware appears to be through exposed, unpatched Remote Desktop services, but can also include email spam and malicious attachments, deceptive downloads, botnets, malicious ads, web injects, fake updates and repackaged and infected installers. Once a malicious actor infects a system, they may attempt to move laterally across the network through tools such as PowerShell Empire, PSExec, etc.

The Cyber Centre recommends that all system owners apply the latest security patches immediately, and that system users are reminded to be vigilant when following unsolicited links and opening unexpected document attachments in emails, even if they come from known contacts.
Click to expand...

Minimalist · Sep 25, 2019

What is Ransomware?

https://www.upguard.com/blog/ransomware

guest · Sep 25, 2019

Ransomware: two pieces of good news
Decryptors released for Yatron and FortuneCrypt ransomware
September 25, 2019
https://securelist.com/ransomware-two-pieces-of-good-news/93355/

Good news #1
We’ve released a decryptor for the Yatron ransomware. The authors of the ransomware chose the first scenario mentioned above and based their ‘creation’ on the code used in Hidden Tear, a well-known sample of open-source ransomware.
However, using third-party code without checking it raises the risk of critical vulnerabilities affecting the overall effectiveness of the program. That’s what happened here. Due to mistakes in the cryptographic scheme we were able to create a decryptor.
Good news #2
We’ve released a decryptor for the unique FortuneCrypt ransomware.
After some analysis, we found that the cryptographic scheme used by the malware is weak and the encrypted files can be easily recovered.
Click to expand...

Decryptors
Both the decryptors mentioned here have been added to our RakhniDecryptor tool, which can be downloaded from the following sources:

https://support.kaspersky.com/viruses/disinfection/10556
https://www.nomoreransom.org/en/decryption-tools.html
Click to expand...

Minimalist · Sep 25, 2019

Emsisoft releases free decryptor for WannaCryFake ransomware

We just released a new free decryption tool for the WannaCryFake ransomware strain.
Click to expand...

https://blog.emsisoft.com/en/34156/emsisoft-releases-free-decryptor-for-wannacryfake-ransomware/

guest · Sep 26, 2019

mood said: ↑

Georgia Police Agencies Still Struggling After Cyberattack
August 22, 2019
https://www.govtech.com/security/Georgia-Police-Agencies-Still-Struggling-After-Cyberattack.html
Click to expand...

Georgia State Patrol working on computer fix after cyber attack
September 26, 2019
https://www.ajc.com/news/crime--law...ix-after-cyber-attack/TOoRXmmVh5JTQ0WnjvGNgM/

Three months after hackers struck, the Georgia Department of Public Safety has 50 workers trying to mitigate the damage to its computer system and regain access to records.
GSP, which has 360,000 cases involving tickets or arrests each year, can’t access its computer system or the digital records it holds.

The headaches caused by the July 26 ransomware attack are most conspicuous at the Georgia State Patrol. Troopers watch over highways and interstates in every corner of the state, writing traffic tickets, arresting fugitives and stopping drunk drivers.

“Our I.T. department is working round the clock to get everything back online. It’s a very tedious process,” DPS spokeswoman Lt. Stephanie L. Stallings told The Atlanta Journal-Constitution. “I wish I could give you a timeline of completion, but I still don’t have one yet.”
Click to expand...

guest · Sep 26, 2019

REvil (Sodinokibi) Ransomware Targets Chinese Users with DHL Spam
September 26, 2019
https://www.bleepingcomputer.com/ne...nsomware-targets-chinese-users-with-dhl-spam/

A new spam campaign is underway that is targeting Chinese recipients to trick them into installing the REvil (Sodinokibi) Ransomware.

This spam campaign was discovered by security researcher onion and pretends to be an email from DHL stating that the delivery of a package has been delayed due to an incorrect customs declaration.
This executable is the REvil (Sodinokibi) ransomware and will immediately delete the victim's Shadow Volume Copies using PowerShell [...]
It will then proceed to encrypt the victim's files and append a random extension to any encrypted files.

In this attack, the ransomware is being distributed as an executable with the name "DHL海关申报单.doc.exe".
Since Windows hides the extension, most users will just see "DHL海关申报单.doc" with a Word icon and think it's a Word document rather than an executable.

To avoid this situation, I recommend that all users enable the viewing of file extensions by using our guide on How to show File Extensions in Windows.
Click to expand...

guest · Sep 26, 2019

Guthrie Public Schools hit by ransomware attack
September 25, 2019
https://www.koco.com/article/guthrie-public-schools-hit-by-ransomware-attack/29215468

Guthrie Public Schools officials said they were the victims of a cyberattack after someone hit the district with a ransomware virus.

Superintendent Mike Simpson told KOCO 5 he was made away of the situation Sept. 16. Because of the safeguards in place, he said no personal information was taken from students or parents.

"When we caught it, it started to encrypt some local files, but our sensitive information is stored off site and by third-party vendors in order to keep it safe," Simpson said.
Although no personal information was compromised, Guthrie Public Schools officials said two computers in the district's tech office were infected.
The hackers got into the district's system through a void that has since been fixed. Simpson told KOCO 5 the district is lucky the situation didn't turn out to be worse.
Click to expand...

guest · Sep 26, 2019

How Sparks, Nevada, is rethinking security after ransomware
September 26, 2019
https://statescoop.com/how-sparks-nevada-is-rethinking-security-after-ransomware/

The ransomware epidemic isn’t going anywhere, and state, county and local governments are all in the crosshairs. There have been roughly 100 reported ransomware attacks against public sector institutions in the U.S. since the beginning of the year.
Cyberattacks can happen to anyone. When it happened to the city of Sparks, Nevada, it led us to take a different approach to detecting and mitigating threats.
[...]
Ransomware attacks will continue until they no longer work for the bad guys. Having been hit with ransomware and recovered from the episode, we have learned (or relearned) some lessons. A good backup strategy is a must. Also, while firewalls and anti-virus tools are important, they aren’t the whole story, so whether you do it yourself or use a service, you need to monitor for what inevitably slips through.
Click to expand...

Minimalist · Sep 27, 2019

Emsisoft releases free decryptor for Avest ransomware

We just released a new free decryption tool for the Avest ransomware strain.

If you have been infected with this ransomware, please download the FREE decryption tool linked below and DO NOT PAY the ransom. A detailed guide is also included.
Click to expand...

https://blog.emsisoft.com/en/34178/emsisoft-releases-free-decryptor-for-avest-ransomware/

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches