Ransomware and Recent Variants

guest · Dec 18, 2020

The Week in Ransomware - December 18th 2020 - Targeting Israel
December 18, 2020
https://www.bleepingcomputer.com/ne...nsomware-december-18th-2020-targeting-israel/

The SolarWinds supply chain attack has dominated this week's cybersecurity news, but there was still plenty of ransomware news this week.

Over the past month, Israel has been targeted in a series of cyberattacks that are attributed to Iran. This week, the Pay2Key ransomware actors targeted on another Israel company in an attack on Intel's Habana Labs. This group appears to be focused on causing havoc for Israeli interests rather than generating a ransom payment.
We also saw a threat actor capitalizing on Cyberpunk 2077's release by distributing ransomware disguised as the game.

Other than that, it has been mostly new variants of existing ransomware released this week.
Click to expand...

guest · Dec 21, 2020

City of Ellensburg is the victim of a ransomware cyberattack
December 21, 2020
https://www.yaktrinews.com/city-of-ellensburg-is-the-victim-of-a-ransomware-cyberattack/

Officials from the City of Ellensburg announced that it was the victim of a cyberattack. The city is now working with both local and federal law enforcement to better understand the issue.

According to Ellensburg Police Captain Dan Hansberry, it was confirmed that the attack was ransomware, which is a type of malware that threatens to release or block access to information until a ransom is paid.
At this point, city officials are trying to discover the best way to proceed.
Click to expand...

The majority of the City of Ellensburg’s network drives and data cannot be accessed. With that being the case, all city departments are being impacted. That includes the utility billing system, administrative services and financial services.
Click to expand...

guest · Dec 22, 2020

Jefferson County PVA office hit by ransomware attack
December 21, 2020
https://www.wdrb.com/news/business/...cle_fdeb5286-43d0-11eb-81f1-770245866a54.html

The Jefferson County Property Valuation Administrator's office has been hit by a ransomware attack, in which hackers are holding the agency's data hostage for payment, PVA Colleen Younger said in an interview Monday.

Younger told WDRB that the agency learned of the attack on Wednesday and had closed its office -- where title researchers and members of the public can look up real estate data -- until Dec. 28.

"Our systems were all down and data was not accessible," Younger said.
But Younger, a Democrat elected to the position in 2019, said the agency is restoring its data through a backup and has no intention of paying the hackers.
Click to expand...

She added that officials are "pretty sure" no personal data was exposed.
The office has hired "a cyber security agency who is in the process of conducting a forensic analysis of the attack," Younger said in a Facebook post about the attack. Younger said they also reported the attack to the FBI.
Click to expand...

guest · Dec 30, 2020

Cornelia hit by ransomware attack
December 29, 2020
https://nowhabersham.com/cornelia-hit-by-ransomware-attack/

The City of Cornelia's data system is offline following a ransomware attack the day after Christmas. City Manager Donald "Dee" Anderson confirmed the attack in a press release to local media on Tuesday.

"We have anticipated situations such as this and, out of an abundance of caution, we have taken down our network while we investigate and restore our data," the release states. "We have alerted law enforcement and we are cooperating with their investigation."
The ransomware attack was discovered on the morning of Saturday, December 26. Anderson says the city "immediately followed our protocol to take down our network to prevent further harm."

The city manager won't comment on how much ransom is being demanded, telling Now Habersham, "We are not going to get into that level of detail at this time." There's currently no timetable for when the issue might be resolved.
Click to expand...

Minimalist · Dec 31, 2020

What’s Next for Ransomware in 2021?

Ransomware response demands a whole-of-business plan before the next attack, according to our roundtable of experts.
Click to expand...

https://threatpost.com/ransomware-getting-ahead-inevitable-attack

guest · Dec 31, 2020

Phobos Ransomware Is Alive and Well, Targeting SMBs and Asking for Ransoms of $19K
December 31, 2020
https://blog.knowbe4.com/phobos-ran...-targeting-smbs-and-asking-for-ransoms-of-19k

In celebrating its two-year birthday this month, experts take a look at the Phobos ransomware in detail and offer up suggestions on how to avoid infection.

Rather than use this article to cover a story of the mass encryption of some enterprise somewhere, I wanted to stop and take a moment to simply look at some new detail provided by the security researchers over at cybersecurity software vendor Heimdal who recently covered Phobos ransomware in detail.
Click to expand...

One of the most notable characteristics of the cybercriminal org behind Phobos is they’ve decided to focus on smaller enterprises (read: the mid-market and smaller) – likely because everyone else is focused on the multi-million-dollar ransoms collected from large enterprises.

According to Heimdal, the average ransom demanded as part of an attack on smaller enterprises is $18,755. That’s pretty small in the world of ransomware, but seems appropriate given smaller businesses aren’t exactly flush with cash.
Click to expand...

guest · Jan 1, 2021

The Week in Ransomware - January 1st 2021 - New Year Edition
January 1, 2021
https://www.bleepingcomputer.com/ne...ransomware-january-1st-2021-new-year-edition/

This holiday edition cover the latest ransomware news from the past two weeks, including known ransomware attacks and law enforcement takedowns.
Click to expand...

guest · Jan 8, 2021

The Week in Ransomware - January 8th 2021 - $150 million
January 8, 2021
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-8th-2021-150-million/

Even though the holidays are over in many countries, it has been a very quiet week for ransomware. Unfortunately, ransomware activity will likely pick up shortly.

This week's biggest news was China APT hackers starting to use ransomware and Ryuk bitcoin wallets indicating they have earned $150 million in ransom payments.
We also had victims, such as Dassault Jet and TransLink, disclosing data breaches after ransomware attacks earlier this year. Other than that, it was your standard release of new variants of existing ransomware. [...]
Click to expand...

guest · Jan 10, 2021

mood said: ↑

Delaware County Critical Systems Restored Following Computer Hack, Officials Say
December 2, 2020
https://philadelphia.cbslocal.com/2...stored-following-computer-hack-officials-say/
Click to expand...

Delaware County officials paid $25,000 in ransom to hackers who infiltrated the county’s computer system
January 7, 2021
https://www.inquirer.com/news/delaware-county-cyberattack-ransom-payment-hackers-20210107.html

Hackers used a malware attack to infiltrate Delaware County’s servers in the fall, and then held employees’ personal data for ransom, ultimately costing the county $25,000 in ransom to restore access to the data, according to county officials.

The attack was first reported Nov. 24, when county officials said the computer network had been compromised by a hack affecting everything but emergency dispatch and the then-ongoing certification of votes in the presidential election.
But in a presentation late Wednesday at county council’s meeting, chief information officer Frank Bilotta revealed the scope of the attack. Hackers — whom Bilotta did not identify — first infiltrated the network through a phishing email opened by a county employee in September.
Click to expand...

Councilmember Christine Reuther echoed those comments, saying that paying the ransom and restoring access to the system allowed the county to avoid missing a payroll cycle for its employees, and ensured that it could pay all of its vendors, who were struggling financially due to COVID-19 restrictions, on time.
Click to expand...

Krusty · Jan 10, 2021

Ransomware attack forces three-week shutdown of NT Government IT system

The Northern Territory Government has revealed the supplier of one its cloud-based IT systems was targeted in a ransomware attack, forcing the system offline for three weeks — but it insists the integrity and confidentiality of government data was never compromised.
Click to expand...

https://www.abc.net.au/news/2021-01-11/ransomware-attack-nt-government-phishing-attempts/13036472

NT Government security systems blocked 46 million suspicious emails last year

Cyber criminals used COVID19 to try to lure public servants into sharing sensitive data

At least one public servant was tricked into purchasing gift cards for a scammer

Click to expand...

"In 2020, a supplier to NT Government … was compromised and subsequently 'ransomwared'," the department said in a statement.

"The system was unavailable for three weeks whilst the vendor recovered the environment."

Instead of paying the ransom, the supplier worked with the Australian Cyber Security Centre and NT Government officials to overcome the issue.

"They took the system offline and restored it from backup copies," the department said.

Business continuity plans were implemented to maintain services during the system outage, it said.

"The confidentiality and integrity of NT Government data was not impacted as a result of the incident."
Click to expand...

Minimalist · Jan 11, 2021

DarkSide ransomware decryptor recovers victims' files for free

Romanian cybersecurity firm Bitdefender has released a free decryptor for the DarkSide ransomware to allow victims to recover their files without paying a ransom.
Click to expand...

https://www.bleepingcomputer.com/ne...re-decryptor-recovers-victims-files-for-free/

guest · Jan 15, 2021

The Week in Ransomware - January 15th 2021 - Locking you up
January 15, 2021
https://www.bleepingcomputer.com/ne...-ransomware-january-15th-2021-locking-you-up/

It has been another quiet week for ransomware, though we did have some interesting stories come out this week.
Click to expand...

guest · Jan 17, 2021

Clearfield Co. Hit by Cyberattack
January 12, 2021
https://gantdaily.com/2021/01/12/clearfield-co-hit-by-cyberattack/

A cyberattack infected all of Clearfield County’s servers and 15 percent of its computers over the weekend.

Commissioner John A. Sobel, board chairman, Tony Scotto and Dave Glass issued the following public statement Tuesday:

“Clearfield County recently detected and is responding to malware activity on its computer network. As soon as we learned of this, we began working to investigate to restore operations and determine the effects of the incident.
Sobel said the county’s IT Director Adam Curry has worked around the clock in response to the cyber incident, and they ask for the public’s patience, as they implement business continuity measures.
Click to expand...

When asked by the press if the county was a deliberate target, Glass said that was still under investigation. He said the malware encrypted data on the servers, making it inaccessible but it doesn’t appear anyone else accessed it either.
The county will look into new antivirus and cybersecurity software, Glass said.

“You’re always playing defense. We have to defend every time, and they only have to be successful once.”
Click to expand...

Minimalist · Jan 19, 2021

The State of Ransomware in the US: Report and Statistics 2020

“In 2019, the U.S. was hit by an unprecedented and unrelenting barrage of ransomware attacks.

Those were the opening words of our last State of Ransomware report. Unfortunately, the barrage continued into 2020 with at least 2,354 US governments, healthcare facilities and schools being impacted.
Click to expand...

https://blog.emsisoft.com/en/37314/the-state-of-ransomware-in-the-us-report-and-statistics-2020/

guest · Jan 22, 2021

The Week in Ransomware - January 22nd 2021 - Calm before the storm
January 22, 2021
https://www.bleepingcomputer.com/ne...ware-january-22nd-2021-calm-before-the-storm/

Ransomware news is slow this week, with mostly small ransomware variants being released and a small number of attacks reported.

This week's biggest news is threat actors hacking the IObit forums to host malware for an IObit phishing scam that infected numerous people with the DeroHE ransomware.

This week's other interesting news is a new threat actor utilizing Windows BitLocker and Diskcryptor to encrypt organization's file and backup servers. A known attack by this group encrypted 40 servers in an attack on the CHwapi Hospital in Belgium, which disrupted medical care. [...]
Click to expand...

guest · Jan 23, 2021

Cyber attack: ransomware victim Montmagne city
January 23, 2021
https://presstories.com/2021/01/23/cyber-attack-ransomware-victim-montmagne-city/

The ransomware type attack took place from 16 to 17 January.

Until yesterday, most of the activities to access the computer system were still blocked, but the Town Hall phone system was finally restored, six days later.
We told Magnimontoise that the process of recovering systems can take weeks or even months. “Experts tell us it’s not a sprint, but a marathon,” he said Magazine Director General of the City, Felix Mike.
Click to expand...

Mr. Micade could not give us details yesterday about a redemption request. The case is still ongoing. If the requested amount is less expensive than rebuilding the municipality’s database it will not refuse to pay the hackers. “We have to weigh the pros and cons. All the shots are on the table.”
Click to expand...

guest · Jan 29, 2021

The Week in Ransomware - January 29th 2021 - Striking back
January 29, 2021
https://www.bleepingcomputer.com/ne...n-ransomware-january-29th-2021-striking-back/

It has been a hectic week, with law enforcement conducting two successful law enforcement operations that will significantly impact ransomware. [...]
Click to expand...

Minimalist · Jan 29, 2021

Fonix ransomware shuts down and releases master decryption key

The Fonix Ransomware operators have shut down their operation and released the master decryption allowing victims to recover their files for free.
Click to expand...

https://www.bleepingcomputer.com/ne...huts-down-and-releases-master-decryption-key/

guest · Jan 30, 2021

UK Research and Innovation (UKRI) discloses ransomware attack
January 30, 2021
https://securityaffairs.co/wordpress/114026/hacking/ukri-ransomware-attack.html

The UK Research and Innovation (UKRI) discloses a ransomware incident that impacted a number of UKRI-related web assets.

Two services were impacted, a portal for our UK Research Office (UKRO) based in Brussels and an extranet used by our Councils.
At the time of writing, it is not clear if threat actors exfiltrated data from the UK agency that reported the incident to the National Crime Agency, the National Cyber Security Centre and Information Commissioner’s Office.

“We are treating an IT incident that has impacted a number of UKRI-related web assets as a cyber attack that has resulted in data being encrypted by a third party.” reads the statement published by UKRI. “The UKRO portal provides an information service to subscribers. The extranet is used to support the peer review process for various parts of UKRI.”
Click to expand...

stapp · Jan 31, 2021

Vovalex is likely the first ransomware written in D

A new ransomware called Vovalex is being distributed through pirated software that impersonates popular Windows utilities, such as CCleaner.
Click to expand...

https://www.bleepingcomputer.com/news/security/vovalex-is-likely-the-first-ransomware-written-in-d/

Minimalist · Feb 4, 2021

New Fonix ransomware decryptor can recover victim's files for free

Kaspersky has released a decryptor for the Fonix Ransomware (XONIF) that allows victims to recover their encrypted files for free.
Click to expand...

https://www.bleepingcomputer.com/ne...decryptor-can-recover-victims-files-for-free/

guest · Feb 5, 2021

The Week in Ransomware - February 5th 2021 - Data destruction
February 5, 2021
https://www.bleepingcomputer.com/ne...ansomware-february-5th-2021-data-destruction/

This week we saw a few large scale attacks and various ransomware reports indicating ransom payments are falling, while attacks are increasingly destroying data permanently. The good news is a new ransomware decryptor was released, allowing victims to recover files for free. [...]
Click to expand...

Minimalist · Feb 7, 2021

Ziggy ransomware shuts down and releases victims' decryption keys

The Ziggy ransomware operation has shut down and released the victims' decryption keys after concerns about recent law enforcement activity and guilt for encrypting victims.
Click to expand...

https://www.bleepingcomputer.com/ne...ts-down-and-releases-victims-decryption-keys/

Minimalist · Feb 11, 2021

Avaddon ransomware fixes flaw allowing free decryption

The Avaddon ransomware gang has fixed a bug that let victims recover their files without paying the ransom. The flaw came to light after a security researcher exploited it to create a decryptor.
Click to expand...

https://www.bleepingcomputer.com/ne...nsomware-fixes-flaw-allowing-free-decryption/

Minimalist · Feb 13, 2021

The Week in Ransomware - February 12th 2021 - More keys released

This week we saw another ransomware shut down its operation and a significant attack against Cyberpunk 2077 game developer CD Projekt Red.

Another operation known as Ziggy Ransomware shut down this week and released the decryption keys for victims. This shut down was due to increased concern about law enforcement action after the disruption and arrests in the Netwalker Ransomware operation.
Click to expand...

https://www.bleepingcomputer.com/ne...omware-february-12th-2021-more-keys-released/

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

stapp Global Moderator

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

stapp Global Moderator

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches