Ransomware and Recent Variants

guest · Nov 7, 2020

Cyber attack targets Norwich-based Flagship Group
November 6, 2020
https://www.bbc.co.uk/news/uk-england-norfolk-54824740

Flagship Group, based in Norwich, said the cyber attack on 1 November took "most of our group's systems offline".

It said the incident had been caused by a suspected phishing or ransomware attack.

"We do not yet have a complete picture of all the data that has been encrypted."
The company also said it had "a high level of security measures" in place to protect data.
Click to expand...

'Considerable disruption'
Chief executive David McQuade apologised to tenants affected by the breach and those experiencing delays in having repairs carried out.
"We are now working towards the recovery of all our systems," he said.
Click to expand...

guest · Nov 12, 2020

mood said: ↑

Steelcase furniture giant hit by Ryuk ransomware attack
October 27, 2020
https://www.bleepingcomputer.com/ne...urniture-giant-hit-by-ryuk-ransomware-attack/
Click to expand...

Steelcase furniture giant down for 2 weeks after ransomware attack
November 12, 2020
https://www.bleepingcomputer.com/ne...ant-down-for-2-weeks-after-ransomware-attack/

Office furniture giant Steelcase says that no information was stolen during a Ryuk ransomware attack that forced them to shut down global operations for roughly two weeks.

Today, the company said in a new 8-K form filed with the SEC that the incident led to a two-week operational shutdown.

"The Company quickly implemented a series of containment and remediation measures to address the situation, conduct a forensics investigation and reinforce the security of its systems," Steelcase said.
Today's filing confirms that the company's business operations were indeed affected by the ransomware attack, something we didn't know after BleepingComputer's requests for more details went unanswered.
Click to expand...

No data stolen from compromised systems
Steelcase said today that it has now resumed normal operations and is working on getting back to normal order lead times by shipping all orders delayed by the shutdown.
Steelcase also said that no sensitive customer or employee data was collected and stolen from any of the systems affected in the ransomware attack.
Click to expand...

guest · Nov 13, 2020

mood said: ↑

JIA computer system infiltrated in ransomware attack
September 16, 2020
https://www.newsbreak.com/news/2061662093944/jia-computer-system-infiltrated-in-ransomware-attack
Click to expand...

JIA sends notices to those potentially affected by ransomware attack
November 11, 2020
https://thebrunswicknews.com/news/l...cle_fcf7f268-c78f-56ae-be6d-7c3063017920.html

Jekyll Island Authority has sent notices to individuals whose data may have been compromised in a recent ransomware attack.

The hackers could have had access to data affecting more than 7,000 individuals and companies who do business with the authority, according to a post on JIA’s website offering an update on the attack.
JIA sent notices to people with whom the authority believes may have had protected health information affected. As a precaution, JIA will provide potentially affected individuals the option of free credit monitoring through NortonLifeLock.

“While there is currently no evidence that your personal information has been misused, we want to provide you with information about the incident, our response and steps you may take to better protect against possible misuse of your personal information should you feel it appropriate to do so,” the JIA wrote in a notice sent to potentially impacted individuals.
Click to expand...

guest · Nov 17, 2020

Nibiru ransomware variant decryptor
November 17, 2020
https://blog.talosintelligence.com/2020/11/Nibiru-ransomware.html

Weak encryption
The Nibiru ransomware is a .NET-based malware family. It traverses directories in the local disks, encrypts files with Rijndael-256 and gives them a .Nibiru extension. Rijndael-256 is a secure encryption algorithm. However, Nibiru uses a hard-coded string "Nibiru" to compute the 32-byte key and 16-byte IV values. The decryptor program leverages this weakness to decrypt files encrypted by this variant.
Ransomware
Nibiru ransomware is a poorly executed ransomware variant. It traverses directories and encrypts files with Rijndael-256. The files are given an extension, .Nibiru, after encryption. The ransomware targets numerous common file extensions but skips critical directories like Program Files, Windows and System Volume Information.
Click to expand...

Compiling
We've tested the Nibiru Ransomware Variant Decryptor tusing Visual Studio Community 2019, version 16.7.6 on Windows 10 running .NET Framework, version 4.8.03752. No additional packages are necessary to compile.
You can download the decryptor over at the Talos GitHub.
Click to expand...

guest · Nov 17, 2020

City of Saint John confirms ransomware virus cyberattack
November 17, 2020
https://globalnews.ca/news/7468519/saint-john-ransomware-virus-cyberattack/

The City of Saint John has confirmed it has been targeted with ransomware.

Mayor Don Darling made the announcement at a news conference Tuesday at Saint John City Hall.
Darling said the virus was discovered Friday during routine monitoring of information technology. He said the city acted quickly to contain the exposure and mitigate risks.

“The city immediately took steps to minimize the impact and protect our systems, notified police and engaged a firm that specializes in cybersecurity,” Darling said. “The government of New Brunswick was also notified.
Click to expand...

City of Saint John hit by 'significant' cyber attack (November 15, 2020)

911 communication system working, all other online services down
There's been a "significant" cyber attack against the City of Saint John, according to a news release from the municipality on Sunday evening.
The city says it has no timeline for a full recovery, and until the issue is resolved it will not be accepting payments for municipal services such as water bills and parking tickets. No late fees will be applied.
Click to expand...

guest · Nov 17, 2020

MSPs Report Ransomware is Still the #1 Malware Threat Affecting Businesses; Cost of Downtime Nearly Doubles Since 2019
November 17, 2020
https://au.finance.yahoo.com/news/msps-report-ransomware-still-1-100000700.html

Datto Holding Corp. ("Datto") (NYSE: MSP), the leading global provider of cloud-based software and technology solutions purpose-built for delivery by managed service providers (MSPs), today unveiled its fifth annual Global State of the Channel Ransomware Report. More than 1,000 MSPs weighed in on the impact COVID-19 has had on the security posture of small and medium businesses (SMBs), along with other notable trends driving ransomware breaches.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20201117005156/en/
Click to expand...

The survey found that ransomware still remains the most common cyber threat to SMBs, with 60% of MSPs reporting that their SMB clients have been hit as of Q3 2020. The impact of such attacks keeps growing: the average cost of downtime is now 94% greater than in 2019, and nearly six times higher than it was in 2018 increasing from $46,800 to $274,200 over the past two years, according to Datto’s research.
Click to expand...

guest · Nov 18, 2020

Hackers attempt ransomware attack on City of Fredericton
November 18, 2020
https://globalnews.ca/news/7470766/cyberattack-ransomware-fredericton/

Less than a week after a cyberattack on the City of Saint John, New Brunswick’s capital confirmed hackers are targeting them, too.

The City of Fredericton said several attempts have been made to infect its computer system in the days that followed the incident in Saint John.
That’s because cyber-criminals try to replicate their successes, according to City of Fredericton Chief Information Officer Adam Bell.

“We saw the exact same attack that was perpetrated on Saint John, attack our system probably three or four days later,” Bell said. “And not once — our logs indicated probably 25 or 30 attempts.”
Click to expand...

Saint John officials announced Sunday it was investigating what is called a “significant cyber attack.” Mayor Don Darling later confirmed the city’s computer network was targeted with ransomware.

“We’re definitely reviewing practices,” said Dustin Lavigne, Bathurst’s manager of information technology. “Reviewing the different layers of security we have in place, how we go about things, looking to see if there’s anything we can improve because, of course, there’s always things we can improve.”
Officials have not revealed the ransom request, but Rogerson believes it could be in the neighbourhood of $150,000.
Click to expand...

guest · Nov 20, 2020

Minimalist said: ↑

ProLock Ransomware teams up with QakBot trojan for network access

https://www.bleepingcomputer.com/ne...ams-up-with-qakbot-trojan-for-network-access/
Click to expand...

QBot partners with Egregor ransomware in bot-fueled attacks
November 20, 2020
https://www.bleepingcomputer.com/ne...ith-egregor-ransomware-in-bot-fueled-attacks/

The Qbot banking trojan has dropped the ProLock ransomware in favor of the Egregor ransomware who burst into activity in September.

Similar to how Ryuk works with TrickBot and DoppelPaymer/BitPaymer work with Dridex for access to networks, the ProLock ransomware has historically worked with Qbot to gain access to compromised networks.
Qbot dumps ProLock for Egregor ransomware
In a new report by Oleg Skulkin, Senior Digital Forensics Analyst at Group-IB. a Singapore-based cybersecurity company, has found that Qbot is has stopped distributing ProLock and is now working with Egregor.
Since their launch in September 2020, Egregor has been one of the most active big game hunting ransomware operations currently active.
Click to expand...

Group-IB: QakBot Big Game Hunting continues: the operators drop ProLock ransomware for Egregor

Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has discovered that QakBot (aka Qbot) operators have abandoned ProLock for Egregor ransomware. Egregor has been actively distributed since September 2020 and has so far hit at least 69 big companies in 16 countries. The biggest ransom demand detected by Group-IB team has been at $4 million worth of BTC.
Click to expand...

Minimalist · Nov 21, 2020

The Week in Ransomware - November 20th 2020 - Don't mess with the turkey

This week we saw two massive attacks that had a signifcant impact on the food supply industry, as well as a demonstration of Egregor's annoying ransom note print bombs.
Click to expand...

https://www.bleepingcomputer.com/ne...november-20th-2020-dont-mess-with-the-turkey/

guest · Nov 22, 2020

Retail giant E-Land closes nearly half of stores due to ransomware attack
November 22, 2020
https://www.koreatimes.co.kr/www/tech/2020/11/694_299692.html

South Korean fashion and retail conglomerate E-Land Group said Sunday it has suspended operations at nearly half of its stores in the country due to a ransomware attack.

The group said its corporate network system was attacked by ransomware early in the morning. Such a malware attack has forced 23 of its 50 branches of NC Department Store and NewCore Outlet to halt their operations, E-Land added.
The group said it has currently shut part of its corporate network system to minimize the damage and has asked the police to investigate the cyberattack. (
Click to expand...

guest · Nov 23, 2020

mood said: ↑

Cybercriminals Target Brazilian Government in a Ransomware Attack
November 5, 2020
https://blog.knowbe4.com/cybercriminals-target-brazilian-government-in-a-ransomware-attack
Click to expand...

Brazilian government recovers from "worst-ever" cyberattack
The attack brought the Superior Electoral Court's systems to a standstill for over two weeks
November 23, 2020
https://www.zdnet.com/article/brazilian-government-recovers-from-worst-ever-cyberattack/

After suffering the most severe cyberattack ever orchestrated against a Brazilian public sector institution, the Superior Electoral Court (STJ, in the Portuguese acronym) has managed to get its systems back up and running, after more than two weeks facing disruption.

After the ransomware attack, which took place in November 3, the STJ's systems were totally unavailable for 26 hours, so that the Federal Police could gather the evidence.
According to the president of the STJ, minister Henrique Martins, the event was "the worst-ever" cyberattack that a Brazilian government body has suffered, both in terms of the dimension and complexity involved.

"Up until that point, our team had not experienced anything similar, and, despite the fact we were ready, we were led towards transformations, which will enhance the way in which the Court deals with information security", the minister said in a statement.
Click to expand...

guest · Nov 25, 2020

France Banijay Group hit by Ransomware
November 24, 2020
https://www.cybersecurity-insiders.com/france-banijay-group-hit-by-ransomware/

France-based Entertainment Company Banijay Group is reported to have become a victim of a ransomware attack where hackers accessed and stole sensitive details of employee, including bank details and home addresses.

High placed sources say that the cyber attack where hackers are seen demanding millions to decrypt or unlock the data disrupted the servers of producer of MasterChef.
Cybersecurity Insiders discovered the attack was carried out on Endemol Shine Group, and the hackers infiltrated other networks through this database. FYI, Banijay acquired Endemol for $2.2 billion last year.
Click to expand...

It is not clear whether the French Production Company will pay the ransom to hackers to free up its database from the malware.
Click to expand...

guest · Nov 25, 2020

mood said: ↑

Sopra Steria hit by cyber attack. IT services group suspected of falling victim to ransomware
October 22, 2020
https://grahamcluley.com/sopra-steria-hit-by-cyber-attack/
Click to expand...

Sopra Steria: Adding up outages and ransomware cleanup, Ryuk attack will cost us up to €50m
November 25, 2020
https://www.theregister.com/2020/11/25/sopra_steria_ransomware_damage_50m_euros/

Sopra Steria has said a previously announced Ryuk ransomware infection will not only cost it "between €40m and €50m" but will also deepen expected financial losses by several percentage points.

The admission comes weeks after the French-headquartered IT outsourcing firm's Active Directory infrastructure was compromised by malicious people who deployed the Ryuk ransomware, using what the company called "a previously unknown strain."

In a statement issued this afternoon, Sopra Steria said: "The remediation and differing levels of unavailability of the various systems since 21 October is expected to have a gross negative impact on the operating margin of between €40m and €50m."
Ominously, it added: "The Group's insurance coverage for cyber risks totals €30m."
Click to expand...

hawki · Nov 25, 2020

"Cybercriminals demanding $500,000 after hacking Delaware County,PA. computer network

Cybercriminals have attacked the Delaware County, Pennsylvania government network and taken it hostage. The criminals are demanding $500,000 to free it up...

Sources told Action News, the cybercriminals gained control of the network on Saturday encrypting files, including police reports, payroll, purchasing, and other databases...

Sources said the county is in the process of paying the $500,000 ransom as it's insured for such attacks..."

https://6abc.com/cybercriminals-demanding-$500k-after-hacking-government-network/8257339/

guest · Nov 25, 2020

Danish news agency rejects ransom demand after hacker attack
November 25, 2020
https://www.dailymail.co.uk/wires/a...ency-rejects-ransom-demand-hacker-attack.html

Denmark´s biggest news agency will stay offline for at least another day following a hacking attack this week and has rejected a ransom demand by hackers to release locked data, the wire service said Wednesday.

Ritzau CEO Lars Vesterloekke couldn't say how big the ransom demand was because those behind the "professional attack" had left "a file with a message" that the agency didn´t open following instructions from its advisers.

"If it goes as expected, then we can gradually be back to normal on Thursday," said Vesterloekke, adding that the attack has forced the editorial systems to be shut down as about a quarter of Ritzau ´s 100 servers have been damaged.
Click to expand...

hawki · Nov 27, 2020

"Ransomware hits largest US fertility network, patient data stolen

US Fertility, the largest network of fertility centers in the U.S., says that some of its systems were encrypted in a ransomware attack that affected the company two months ago, in September 2020.

The US Fertility (USF) network is comprised of 55 locations across 10 states that completed almost 25,000 IVF cycles in 2018 through its clinics and more than 80 physicians...

Protected health information stolen in the attack..."

https://www.bleepingcomputer.com/ne...est-us-fertility-network-patient-data-stolen/

guest · Nov 27, 2020

The Week in Ransomware - November 27th 2020 - Attacks continue
November 27, 2020
https://www.bleepingcomputer.com/ne...nsomware-november-27th-2020-attacks-continue/

With the USA holidays, this has been a relatively slow week in new research being released. We did, though, see some organizations get attacked or report historical attacks.
Last weekend, South Korean retail giant E-Land suffered a ransomware attack that forced them to close 23 retail stores while they recovered. [...]
Click to expand...

guest · Dec 2, 2020

hawki said: ↑

"Cybercriminals demanding $500,000 after hacking Delaware County,PA. computer network

Cybercriminals have attacked the Delaware County, Pennsylvania government network and taken it hostage. The criminals are demanding $500,000 to free it up... [...]
https://6abc.com/cybercriminals-demanding-$500k-after-hacking-government-network/8257339/
Click to expand...

Delaware County Critical Systems Restored Following Computer Hack, Officials Say
December 2, 2020
https://philadelphia.cbslocal.com/2...stored-following-computer-hack-officials-say/

Delaware County says critical systems have been restored following a computer hack that compromised part of its network last week.

The county says the security breach was caused by malware, and that they are working to determine what, if any, information was compromised.
Sources tell Eyewitness News the hackers demanded a ransom to give up control of the network and that the county couldn’t access police reports, payroll, or other databases and files.
Click to expand...

guest · Dec 3, 2020

Kmart nationwide retailer suffers a ransomware attack
December 3, 2020
https://www.bleepingcomputer.com/ne...ionwide-retailer-suffers-a-ransomware-attack/

US department store Kmart has suffered a ransomware attack that impacts back-end services at the company, BleepingComputer has learned.
Kmart Windows domain hit with ransomware
BleepingComputer has learned that Kmart suffered a cyberattack by the Egregor ransomware operation this week that encrypted devices and servers on the network.
A ransom note shared with BleepingComputer shows that the 'KMART' Windows domain was compromised in the attack.

While online stores continue to operate, the 'Transformco Human Resources Site,' 88sears.com, is currently offline. Employees said that the outage is caused by the recent ransomware attack.
Click to expand...

It is unknown if the attackers stole data, how many devices were encrypted, or the ransom amount demanded by the Egregor cybercrime group.
BleepingComputer has reached out to Kmart and their parent company Transformco, but has not received a response yet.
Click to expand...

guest · Dec 4, 2020

The Week in Ransomware - December 4th 2020 - Education under attack
December 4, 2020
https://www.bleepingcomputer.com/ne...are-december-4th-2020-education-under-attack/

It has been another rough week for the enterprise and education as ransomware continues to impact business operations and shut down schools.
Click to expand...

guest · Dec 10, 2020

Web hosting giant Netgain forced offline after ransomware attack
Thousands of servers are reportedly still offline
December 9, 2020
https://www.techradar.com/news/web-hosting-giant-netgain-forced-offline-after-ransomware-attack

Following a ransomware attack that occurred at the end of November, the web hosting and IT service provider Netgain has been forced to take some of its data centers offline.

As reported by BleepingComputer, Netgain set out a series of emails to its customers informing them it had fallen victim to a ransomware attack on November 24. A few days later at the beginning of December, customers then began receiving emails from the firm saying that they may experience “system outages or slowdowns” following a cyberattack on the hosting provider.
Click to expand...

We'll likely find out more once Netgain has restored its servers but currently it is unknown as to which ransomware was used in the attack and no cybercriminal group has claimed responsibility yet.
Click to expand...

guest · Dec 11, 2020

Payroll system compromised in ransomware attack on Town of Ludlow
Hampden County
December 10. 2020
https://www.wwlp.com/news/local-new...mised-in-ransomware-attack-on-town-of-ludlow/

LUDLOW, Mass. (WWLP) – Documents relating to the payroll system of employees at Ludlow Town Hall were illegally accessed in a cyberattack attack on Wednesday, according to officials.

In an email to 22News Thursday evening, Ludlow officials said the town was a victim of a ransomware attack that “impacted many of the town’s IT infrastructure systems, including its payroll system.”
The town added the team is also conducting a forensic investigation to determine whether any data was compromised during the cyber-attack.
Click to expand...

guest · Dec 11, 2020

The Week in Ransomware - December 11th 2020 - Targeting K-12
December 11, 2020
https://www.bleepingcomputer.com/ne...ransomware-december-11th-2020-targeting-k-12/

This week we continued to see ransomware target businesses, education, and healthcare with cyberattacks that disrupt operations and lead to school closings.
Click to expand...

guest · Dec 14, 2020

Cruise Company Hurtigruten Hit By ‘Serious’ Cyber Attack
December 14, 2020
https://gcaptain.com/cruise-company-hurtigruten-hit-by-serious-cyber-attack/

Norwegian cruise company Hurtigruten said it had suffered a serious ransomware cyber attack on Monday and several of its systems are paralysed.

But it said it had no safety concerns for two ships heading up to the far north of Norway, the cyber attack had not disrupted communication with them and it did not expect a material impact on its finances.

“This is a serious attack. Hurtigruten’s global IT infrastructure appears to be affected,” Ole-Marius Moe-Helgesen, the company’s head of IT, said in a statement, adding it appeared to be a ransomware attack.
The company had implemented “comprehensive measures” to limit the damage, he said.
Click to expand...

guest · Dec 15, 2020

Ransomware attack causes utility billing issues in Independence
December 14, 2020
https://www.kshb.com/news/local-new...causes-utility-billing-issues-in-independence

People in Independence are unable to pay their utility bills online due to a ransomware attack on the city's computer systems.

Zach Walker, Independence city manager, said 90 percent of the billing issues the city is experiencing is due to the cyberattack.

"In order to protect the integrity of our systems, when we started noticing some malicious activity, we took all of our systems offline," Walker said. "One of the systems that was compromised when we voluntarily took it off of line was the utility billing system."
Walker said the city is not going to penalize people for failure to pay until the ransomware and staffing issues are resolved.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches