Ransomware and Recent Variants

guest · Jul 31, 2020

Canadian MSP discloses data breach, failed ransomware attack
July 31, 2020
https://www.bleepingcomputer.com/ne...scloses-data-breach-failed-ransomware-attack/

Managed service provider Pivot Technology Solutions has disclosed that it was the victim of a ransomware attack that resulted with sensitive information being accessed by the hackers.
The incident occurred last month and hit impacted data held by the parent company and its subsidiaries and/or former and current affiliates.
No encrypted systems
Threat actors were not able to complete the attack and encrypt files on the company systems but they spent enough time on the network to access sensitive information and also steal some of it.

An investigation of the incident conducted by a cyber forensic firm revealed on July 1 that the intruders had access to and exfiltrated “limited personal information of US employees and consultants.”
Click to expand...

Following this incident, all companies have improved their security protocols for defending their networks, email systems, workstations, and personal information.
Click to expand...

Minimalist · Jul 31, 2020

WastedLocker: technical analysis

The use of crypto-ransomware in targeted attacks has become an ordinary occurrence lately: new incidents are being reported every month, sometimes even more often.
Click to expand...

https://securelist.com/wastedlocker-technical-analysis

guest · Jul 31, 2020

mood said: ↑

Legal services giant Epiq Global offline after ransomware attack
March 3, 2020
https://techcrunch.com/2020/03/02/epiq-global-ransomware/
Click to expand...

After ransomware attack, legal services company Epiq faces California privacy lawsuit
July 30, 2020
https://www.reuters.com/article/epi...aces-california-privacy-lawsuit-idUSL2N2F12Q3

Lawyers for Epiq Systems Inc have removed a lawsuit to federal court that alleges the legal services provider failed to adequately protect personal information under California’s consumer privacy law.

The proposed class action lawsuit, originally filed in California state court and removed to federal court on Wednesday, claims that individuals “face a lifetime risk of identity theft” after the Missouri-based company was hit by a ransomware attack in February.
Click to expand...

guest · Jul 31, 2020

The Week in Ransomware - July 31st 2020 - Cooked Crab
July 31, 2020
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-july-31st-2020-cooked-crab/

With No More Ransom turning 4, Garmin suddenly recovering from their ransomware attack, and a GandCrab affiliate being arrested in Belarus, it has been quite a week when it comes to ransomware news.

The biggest story of the week is Garmin enabling services again and the rumors that it paid a $5 million ransom for the decryptor. Fast forward to the end of the week, and the next big news is the arrest of a GandCrab ransomware affilaite in Belarus. [...]
Click to expand...

guest · Aug 1, 2020

Confirmed: Garmin received decryptor for WastedLocker ransomware
August 1, 2020
https://www.bleepingcomputer.com/ne...ceived-decryptor-for-wastedlocker-ransomware/

BleepingComputer can confirm that Garmin has received the decryption key to recover their files encrypted in the WastedLocker Ransomware attack.

BleepingComputer was the first to confirm that they suffered a cyberattack by the WastedLocker Ransomware operators after employees shared photos of encrypted workstations, and we found a sample of the ransomware utilized in the attack.
Employees later shared with BleepingComputer that the ransom demand was $10 million.

After a four day outage, Garmin suddenly announced that they were starting to restore services, and it made us suspect that they paid the ransom to receive a decryptor
Click to expand...

Confirmed: Garmin received a WastedLocker decryption key
Today, BleepingComputer gained access to an executable created by the Garmin IT department to decrypt a workstation and then install a variety of security software on the machine.

Using the sample of WastedLocker from the Garmin attack, BleepingComputer encrypted a virtual machine and tested the decryptor to see if it would decrypt our files.
In our test, demonstrated in the video below, the decryptor had no problems decrypting our files.
Click to expand...

guest · Aug 4, 2020

WastedLocker ransomware abuses Windows feature to evade detection
August 4, 2020
https://www.bleepingcomputer.com/ne...re-abuses-windows-feature-to-evade-detection/

The WastedLocker ransomware is abusing a Windows memory management feature to evade detection by security software.
WastedLocker uses Windows Cache Manager
Over the past few weeks, the WastedLocker Ransomware has become notorious after being attributed to the sanctioned Evil Corp hacking group and used to attack Garmin.
In a new report shared with BleepingComputer prior to release, Sophos security researchers explain how WastedLocker uses the Windows Cache Manager to evade detection.

To bypass detection by anti-ransomware solutions, WastedLocker includes a routine that opens a file, reads it into the Windows Cache Manager, and then closes the original file.
Click to expand...

As the Windows Cache Manager is running as a System process, security software will see the writing of the encrypted data from an allowed and legitimate Windows process, as shown below.
Due to this, behavioral detections in anti-ransomware software will see an allowed process writing the encrypted data and not detect that anything is wrong.
Click to expand...

Sophos: WastedLocker’s techniques point to a familiar heritage

WastedLocker’s evades detection by performing most operations in memory, and shares several characteristics with a more well known ransomware family
Click to expand...

guest · Aug 5, 2020

Cyberattack causes Lafayette computer outage; officials pay $45,000 ransom
August 4, 2020
https://www.dailycamera.com/2020/08...e-computer-outage-officials-pay-45000-ransom/

Lafayette officials announced the city was hit with a ransomware attack on the city’s computer system on July 27.

The attack disabled the network services causing city emails, phones, online payments and reservation systems to be affected. Over the weekend, city officials paid $45,000 to retrieve the key to unlock the encrypted data.
According to a statement, city staff detected the infection and ransom notification at 6:50 a.m. July 27 and disabled all network connections to contain the malware spread. According to the city, a preliminary investigation shows the ransomware entered the city’s network through a phishing scam or brute force, and looks like a random attack.
Click to expand...

She said the city did not share updates because it would have created a “strategic disadvantage” for the city.
Financial data appears to be recoverable from unaffected backups, according to the statement.

“Personal credit card information was not compromised,” according to the statement. “There is no evidence to suggest personal data was compromised, but out of an abundance of caution, residents and employees are advised to be vigilant to monitor accounts for suspicious activity.”
Click to expand...

guest · Aug 5, 2020

Interpol: Lockbit ransomware attacks affecting American SMBs
August 4, 2020
https://www.bleepingcomputer.com/ne...t-ransomware-attacks-affecting-american-smbs/

American medium-sized companies are actively targeted by LockBit ransomware operators according to an Interpol report on the impact the COVID-19 pandemic had on cybercrime around the world.
"The resulting analysis was supplemented by information provided by private sector partners and the INTERPOL Regional Working Groups on Cybercrime," the Interpol says.
American SMBs in LockBit's line of fire
As part of a short summary of regional cybercrime trends, the International Criminal Police Organization (Interpol) says [PDF] that "a ransomware campaign carried out mainly through LOCKBIT malware is currently affecting medium-sized companies in some countries within this region."
Click to expand...

This ransomware strain's operators use the publicly available CrackMapExec penetration testing tool to move laterally once they get a foothold on a victim's network.

Based on their analysis, CERBER, NetWalker, and Ryuk were the top ransomware families recently detected by Interpol private partners and they are seen as "constantly evolving to maximize the potential damage of a single attack as well as the financial profit for its perpetrators."
Click to expand...

guest · Aug 6, 2020

mood said: ↑

Redcar and Cleveland Borough Council says '90%' of IT systems running again after cyber attack
May 2, 2020
https://www.itv.com/news/tyne-tees/...-it-systems-running-again-after-cyber-attack/
Click to expand...

Redcar cyber-attack 'cost council £10.4m'
August 5, 2020
https://www.bbc.co.uk/news/uk-england-tees-53662187

About 135,000 people were without online public services after Redcar and Cleveland's website and computers were targeted in February.

The local authority has been in discussions with the government over covering the cost of the attack.
It said it had made "improvements" to its cyber-defences "with further upgrades planned".
Click to expand...

'Far more advanced'
A figure of £10.4m has been given to the government along with other information to assist with a due diligence process.
It has agreed to provide support to the council, according to the budget report.

Extensive recovery or replacement work to the IT infrastructure and systems made up £2.4m of the overall cost, the Local Democracy Reporting Service said.
The attack continues to be subject to a criminal investigation.
Click to expand...

guest · Aug 6, 2020

Emsisoft Decryptor for CheckMail7
August 6, 2020
https://www.emsisoft.com/ransomware-decryption-tools/CheckMail7

CheckMail7 encrypt's its victim's files and appends the extension ".checkmail7@protonmail.com".
The ransom note "warning.txt" contains the following text: [...]
Click to expand...

Download: https://www.emsisoft.com/ransomware-decryption-tools/download/CheckMail7

guest · Aug 7, 2020

The Week in Ransomware - August 7th 2020 - Businesses under siege
August 7, 2020
https://www.bleepingcomputer.com/ne...mware-august-7th-2020-businesses-under-siege/

This week illustrated how pervasive ransomware has become with news of two large and well-known companies getting hit with ransomware attacks, with more surely to come.
Over the weekend, BleepingComputer found a WastedLocker decryptor used by Garmin to decrypt their files, meaning that they paid the ransom to get the decryption key.

As ransomware groups consolidate into highly skilled operations, enterprises need to increase monitoring, lock down their perimeter, and make sure all gateway devices and RDP servers properly protected. [...]
Click to expand...

guest · Aug 10, 2020

Windows ransomware attackers have upped their game in recent months: Sophos
August 10, 2020
https://www.itwire.com/security/win...upped-their-game-in-recent-months-sophos.html

Principal researcher Andrew Brandt said, in a detailed study titled Ransomware's evasion-centric arms race, that nearly every ransomware attack involved live engagement by the attackers, who first surveilled and took inventory of the intended victim's network before focusing attention on closing down or disabling existing layers of protection.
This is the second in a series of five studies on ransomware published by Sophos; iTWire reported on the first, a detailed study of WastedLocker, last week.

He said these attackers had in their possession an exhaustive set of tools used to spy, escalate privileges, steal, sniff, or stage brute-force attacks on Windows systems.
Click to expand...

"If endpoint protection tools are the metaphorical net below the high wire act, applying patches and shutting down unnecessary holes in the firewall are the daily practice routines that will keep you out of the net when it matters most."
Click to expand...

Sophos: The realities of ransomware: The evasion arms race

Behavioral shifts changed the ransomware landscape as criminals challenge defenses
Click to expand...

guest · Aug 12, 2020

mood said: ↑

Cyberattack causes Lafayette computer outage; officials pay $45,000 ransom
August 4, 2020
https://www.dailycamera.com/2020/08...e-computer-outage-officials-pay-45000-ransom/
Click to expand...

Ransomware: Why one city chose to the pay the ransom after falling victim
After being hit with ransomware, one city faced a tough decision
August 12, 2020
https://www.zdnet.com/article/ranso...e-to-the-pay-the-ransom-after-falling-victim/

A US city has explained why it gave into the demands of cyber criminals and paid a ransom demand of $45,000 following a ransomware attack.

After examining the incident the city of Lafayette opted to pay the cyber criminals the ransom they demanded, perceiving it to be the quickest and most cost effective way to restore municipal services to residents, rather than attempting to restore services from scratch.

"I can tell you that using taxpayer funds to pay a ransom was definitely not the direction the city wanted to take. We attempted to pursue any possible avenue to avoid paying the ransom," Lafayette Mayor Jamie Harkins said in a video statement.
As a result, the decision was taken to pay a ransom of $45,000 to cyber criminals to retrieve the ransomware decryption key and the city is restoring the encrypted data in an effort to return services to normal – although at the time of writing, many services still remain unavailable.
Click to expand...

guest · Aug 15, 2020

The Week in Ransomware - August 14th 2020 - Crime made easy
August 15, 2020
https://www.bleepingcomputer.com/ne...-ransomware-august-14th-2020-crime-made-easy/

Ransomware continues its siege on organizations worldwide, with new variants released every day and attacks continuing to be reported.

The biggest news this week is the information about a hacking toolkit that makes it easy for inexperienced hackers to compromise a network and deploy a ransom.
Otherwise, saw some news about a Colorado city that paid a $45,000 ransom and Avaddon launching a new data leak site to further extort their victims. [...]
Click to expand...

guest · Aug 16, 2020

Business technology giant Konica Minolta hit by new ransomware
August 16, 2020
https://www.bleepingcomputer.com/ne...y-giant-konica-minolta-hit-by-new-ransomware/

Business technology giant Konica Minolta was hit with a ransomware attack at the end of July that impacted services for almost a week, BleepingComputer has learned.
It started with an outage
On July 30th, 2020, customers began reporting that Konica Minolta's product supply and support site was not accessible and was displaying the outage message shown below.

Some Konica Minolta printers were also displaying a 'Service Notification Failed' error, which led Konica Minolta to update their outage message to contain a link to this support document.
Konica Minolta hit by the RansomEXX ransomware
Soon after, a source shared a copy of the ransom note used in the attack on Konica Minolta with BleepingComputer.
Click to expand...

BleepingComputer also learned that devices in the company were encrypted, and files had the '.K0N1M1N0' extension appended to them.
This ransom note belongs to a relatively new ransomware called RansomEXX, which we reported on at the end of June 2020 when it was used in an attack on the Texas Department of Transportation.
Click to expand...

guest · Aug 19, 2020

WannaRen Decryption Tool
August 19, 2020
https://labs.bitdefender.com/2020/08/wannaren-decryption-tool/

A decryptor for the WannaRen ransomware is now available for download.

Initially spotted in April 2020, WannaRen is mostly spreading through websites offering “cracked” software. This new decryptor works on all known versions of WannaRen ransomware.
How to use this tool [...]
Click to expand...

WannaRen decryptor (8.13 MB): http://download.bitdefender.com/am/malware_removal/BDWannaRenDecryptTool.exe

ZDNet: WannaRen ransomware author contacts security firm to share decryption key

[...] WannaRen spread like wildfire, far beyond what the ransomware's authors had intended, creating more havoc than they anticipated, and the reason why, in the end, the malware's authors gave up the master decryption key for free, so all victims could eventually recover their files.
Click to expand...

guest · Aug 21, 2020

Warehouse management software biz SnapFulfil hit by ransomware: It's not just the big dogs getting KO'd
August 21, 2020
https://www.theregister.com/2020/08/20/snapfulfil_ransomware_attack/

A UK cloud-based warehouse management software provider was struck by ransomware earlier this week.

Emails from SnapFulfil, a trading name of Synergy Logistics, sent to its customers late last week and shown to The Register, revealed how a ransomware attack targeted the company's services, disrupting warehouse operations for at least one of its customers.

"We have been targeted by a ransomware attacker. We believe the data is safe. All the work done over the last few days has included additional security and changes to mitigate another attack," said one email shown to El Reg.
Click to expand...

In a statement Synergy Logistics told The Register: "We have been working in partnership with the National Crime Agency and the National Cyber Security Centre to restore our systems and mitigate impact for our customers. The majority of our customers are now fully operational and safeguards have been put in place to minimise the risk of future malicious attacks."
Click to expand...

guest · Aug 21, 2020

The Week in Ransomware - August 21st 2020 - Ransomware Ahoy!
August 21, 2020
https://www.bleepingcomputer.com/ne...-ransomware-august-21st-2020-ransomware-ahoy/

While it wasn't a big week for new ransomware variants, we did learn about some ransomware attacks against very large organizations.

This week BleepingComputer broke the story that Konica Minolta was hit with ransomware at the end of July that impacted some of their USA services.
This was followed by Carnival Corporation, who disclosed in a 6-K SEC filing that one of their cruise brands got hit with ransomware. [...]
Click to expand...

guest · Aug 24, 2020

Ransomware attack hits TFI’s Canadian courier divisions
Canpar Express, ICS Courier, Loomis Express, TForce Integrated Solutions impacted
August 23, 2020
https://www.freightwaves.com/news/b...omware-attack-hits-canadian-courier-divisions

A ransomware attack hit TFI International’s (NYSE:TFII) four Canadian courier divisions on Thursday, two days after the transportation and logistics company raised millions of dollars in a share offering.

The attack impacted “some systems” of Canpar Express, ICS Courier, Loomis Express and TForce Integrated Solutions, according to notices posted to the couriers’ websites.

“We continue to meet most customer shipping needs and we are not aware of any misuse of client information,” the notices state. “Out of an abundance of caution we want to make our clients aware of the incident, should you be experiencing any issues.”
The extent of the attack wasn’t clear as of Sunday. A spokesperson for TFI International did not immediately respond to FreightWaves’ request for comment.
TFI told its customers that the attack is under investigation.
Click to expand...

guest · Aug 27, 2020

mood said: ↑

Cyberattack causes Lafayette computer outage; officials pay $45,000 ransom
August 4, 2020
https://www.dailycamera.com/2020/08...e-computer-outage-officials-pay-45000-ransom/
Click to expand...

Notice of security breach for City of Lafayette residents, employees, and customers
August 24, 2020
https://cityoflafayette.com/CivicAlerts.aspx?AID=5746

NOTICE OF SECURITY BREACH – August 24, 2020
This public notice is intended to advise residents, employees, and customers of an incident involving a cyberattack on the City of Lafayette’s computer network system, and possible security breach of personal information stored on the City’s system. Although we are unaware of any actual acquisition or misuse of personal information, we are providing notice to potentially affected individuals about the incident and resources available to protect individuals against possible identity theft or fraud.
Click to expand...

guest · Sep 4, 2020

Thanos Ransomware adds Windows MBR locker that fails every time
September 4, 2020
https://www.bleepingcomputer.com/ne...dds-windows-mbr-locker-that-fails-every-time/

A new Thanos ransomware strain is trying and failing to deliver the ransom note onto compromised systems by overwriting the computers' Windows master boot record (MBR).

The new Windows MBR locker module has been discovered by security researchers at Palo Alto Networks' Unit 42 while analyzing two attacks were Thanos ransomware affiliates successfully encrypted devices of state-controlled organizations from the Middle East and North Africa during early July 2020.

"Overwriting the MBR is a more destructive approach to ransomware than usual," Unit 42 threat intelligence analyst Robert Falcone said. "Victims would have to expend more effort to recover their files – even if they paid the ransom."
"Fortunately, in this case, the code responsible for overwriting the MBR caused an exception because the ransom message contained invalid characters, which left the MBR intact and allowed the system to boot correctly."
Click to expand...

The threat actors also used a layer-based approach to deliver the payloads, with custom PowerShell scripts, inline C# code, and shellcode being used to deliver the ransomware locally and to other systems on the victims' networks using the stolen credentials mentioned above.
Click to expand...

Palo Alto Networks - Unit42: Thanos Ransomware: Destructive Variant Targeting State-Run Organizations in the Middle East and North Africa

While the Thanos ransomware is not new, it appears that it is still under active development as the variant used in these attacks contained new functionality. The new functionality included the ability to detect and evade more analysis tools, the enumeration of local storage volumes via a technique used by the Ragnar Locker ransomware and a new capability to monitor for newly attached storage devices.
Click to expand...

guest · Sep 4, 2020

The Week in Ransomware - September 4th 2020 - Stay Alert!
September 4, 2020
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-4th-2020-stay-alert/

In this action-packed two-week edition of the 'Week in Ransomware', we see many new variants, with some being actively distributed. We have also seen some recent reports regarding existing ransomware, such as Conti and Dharma. [...]

It's a holiday weekend in the USA, so be sure to stay alert, pay extra attention to your monitoring logs, and tighten up exposed servers as its a prime time for a ransomware attack.
Click to expand...

guest · Sep 5, 2020

“Cyrat” Is a New Ransomware Strain Disguised as a DLL Fixer
...under heavy development going for payments of $500-$1,000
September 3, 2020
https://www.technadu.com/cyrat-new-ransomware-strain-disguised-dll-fixer/192359/

A new ransomware strain called “Cyrat” has appeared in the wild, tricking internet users and finding its way into their machines disguised as a DLL fixer. The first signs of Cyrat appeared on August 25, 2020, and one of the early reports analyzing the characteristics of this ransomware comes from malware analyst Karsten Hahn.

According to the first details that have surfaced, this malware was compiled with Python 3.7 and converted to a Windows PE (pre-installation environment) through PyInstaller.
The encryption scheme used in Cyrat is the Fernet symmetric encryption, which is pretty unusual in the field
The resulting files have the “.CYRAT” filename extension.
Click to expand...

Cyrat sets a wallpaper which depicts a stock ransomware infection photo, while the ransom note demands the payment of $1,000 in BTC, or $500 if completed within 48 hours. To prevent system restoration, Cyrat disables the CMD, the registry tools, the task manager, removes the RUN command from the start menu, and sets “recoveryenabled” to “No.”

Karsten Hahn says Cyrat crashed when tested, so it’s clear that this is still “work in progress.” However, the researcher points out that the actors are active and respond to victims’ emails, so it’s only a matter of time before the infection rates spike.
Click to expand...

G Data (Karsten Hahn): DLL Fixer leads to Cyrat Ransomware

The target platform is undoubtedly Windows because the PyInstaller executable only works there.
Oddly, there are also checks for Linux and Darwin (core of many Apple operating systems) in the main body without any changes in the following code which is still Windows targeted.
Click to expand...

guest · Sep 8, 2020

Ransomware delays first day of school for Hartford, Connecticut
September 8, 2020
https://www.bleepingcomputer.com/ne...first-day-of-school-for-hartford-connecticut/

The Hartford School District in Connecticut has postponed their first day of school as they struggle with getting classroom and transportation systems restored and running after a Labor Day holiday weekend ransomware attack.

In a press conference this morning, Hartford Mayor Luke Bronin stated that the school district's network was breached on Thursday, September 3rd.
The state's capital did not become aware of the attack until Saturday, September 5th, after the hackers deployed ransomware and began encrypting the devices on the district's network.

"There was no specific ransom demand. There was language, text that was installed and discovered on many systems, that said this is a ransomware attack and asked that we contact a particular email address. Needless to say that we are not contacting that email address. We will let law enforcement deal with that," Bronin stated in a live press conference this morning.
Click to expand...

A source has told BleepingComputer that the Hermes ransomware is thought to be behind the attack on the school district's systems, but BleepingComputer has not been able to verify these claims.
Click to expand...

guest · Sep 9, 2020

Zeppelin Ransomware Returns with New Trojan on Board
September 9, 2020
https://threatpost.com/zeppelin-ransomware-returns-trojan/159092/

The Zeppelin ransomware has sailed back into relevance, after a hiatus of several months.

A wave of attacks were spotted in August by Juniper Threatlab researchers, making use of a new trojan downloader. These, like an initial Zeppelin wave observed in late 2019, start with phishing emails with Microsoft Word attachments (themed as “invoices”) that have malicious macros on board. Once a user enables macros, the infection process starts.
The binary sleeps for 26 seconds “in an attempt to out-wait dynamic analysis in an automated sandbox and then runs the ransomware executable,” according to the recently released analysis.

“As with previous versions, the Zeppelin executable checks the computer’s language settings and geolocation of the IP address of the potential victim to avoid infecting computers in Russia, Belarus, Kazakhstan and Ukraine.”
The latest campaign has affected around 64 known victims and targets, Juniper researchers noted, indicating a certain level of targeting.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches