Ransomware and Recent Variants

guest · Jul 13, 2018

The Week in Ransomware - July 13th 2018 - CoinVault Court Case & More
July 13, 2018
https://www.bleepingcomputer.com/ne...july-13th-2018-coinvault-court-case-and-more/

This week has mostly been small variants released, with a bunch of new Scarab Ransomware variants. The most interesting ransomware news this week are the CoinVault authors being in a Netherlands court in front of a three-judge panel. [...]
Click to expand...

guest · Jul 16, 2018

Magniber Ransomware Expands From South Korea to Target Other Asian Countries
July 16, 2018
https://www.bleepingcomputer.com/ne...-south-korea-to-target-other-asian-countries/

After spending nine months targeting only South Korean users, the Magniber ransomware has expanded its targeting spectrum and is now also capable of infecting users who also feature a Chinese (Macau, China, Singapore) and Malay (Malaysia, Brunei) PC language setting.

The change was first spotted on July 5 by independent security researcher MalwareHunter. Bleeping Computer along with several other security researchers have kept an eye on this issue.
Expansion outside South Korea confirmed
But this time, it appears to be true. The research team from Malwarebytes has recently discovered important changes in the delivery and the binary of this ransomware.

Furthermore, the entire source code is now of a higher quality, two Malwarebytes researchers wrote today in a technical analysis.
Click to expand...

guest · Jul 20, 2018

The Week in Ransomware - July 20th 2018 - Developer's Vent, Ransomware Attacks, and More
July 20, 2018
https://www.bleepingcomputer.com/ne...-developers-vent-ransomware-attacks-and-more/

While it has been pretty slow for new ransomware this week, there was a quite a bit of ransomware related news.

This week we learned that LabCorp's cyberattack was actually a SamSam Ransomware infection, a ransomware developer decided to vent to security researchers because a site called his ransomware a scam, Magniber starts targeting other Asian countries, and Kaspersky gives us a behind-the-scenes look at how they took down Cryakl. [...]
Click to expand...

guest · Jul 23, 2018

Shrug ransomware victim? Here's how to retrieve your locked files for free
'Newbie' malicious developers have a go at building and distributing ransomware - but mistakes mean damage can be avoided.
July 23, 2018
https://www.zdnet.com/article/shrug...s-how-to-retrieve-your-locked-files-for-free/

Shrug ransomware first appeared in the wild on July 6 and is embedded in fake software and gaming apps. Those who get tricked into downloading and running the file-encrypting malware are met with an extensive and mocking ransom note penned by an attacker calling themselves Martha.

Shrug uses a random key generation for each user - but researchers at at cyber security company LMNTRIX have found that authors left the keys needed to unlock the files in the directory, unintentionally enabling victims to retrieve their files without paying the ransom. The keys were found embedded in the registry, completely unencrypted. [...]
Click to expand...

guest · Jul 27, 2018

The Week in Ransomware - July 27th 2018 - Ransomware Still a Threat
July 27, 2018
https://www.bleepingcomputer.com/ne...are-july-27th-2018-ransomware-still-a-threat/

While the distribution of ransomware has definitely decreased, it is still very much a threat as seen by the Alaskan borough of Matanuska-Susitna and the shipping company Cosco getting hit by ransomware this week. Both attacks shut down their operations and caused normal workflow to be halted.

The good news, though, is that decryptors continue to be created for some ransomware families, which will allow victims to get their files back for free. [...]
Click to expand...

guest · Jul 31, 2018

BitPaymer Ransomware Infection Forces Alaskan Town to Use Typewriters for a Week
July 31, 2018
https://www.bleepingcomputer.com/ne...s-alaskan-town-to-use-typewriters-for-a-week/

On Monday, officials from Matanuska-Susitna (Mat-Su), a borough part of the Anchorage Metropolitan Statistical Area, said they are still recovering from a ransomware infection that took place last week, on July 24.

The ransomware infection crippled the Borough's government networks and has led to the IT staff shutting down a large swath of affected IT systems.
Mat-Su hit by "multi-pronged, multi-vectored attack"
Wyatt called the virus "a multi-pronged, multi-vectored attack." He also described it as "not a single virus but multiple aspects of viruses together including trojan horse, Cryptolocker, time bomb, and dead man’s switch." Wyatt also said the "virus" also searched and tried to corrupt the borough's backups, which he says, it failed.

"This is a very insidious, very well-organized attack," Wyatt said. "It's not a kid in his mom’s basement."
[...] PDF report [...]
Click to expand...

guest · Jul 31, 2018

SamSam Ransomware Crew Made Nearly $6 Million From Ransom Payments
July 31, 2018
https://www.bleepingcomputer.com/ne...w-made-nearly-6-million-from-ransom-payments/

The SamSam ransomware has earned its creator(s) more than $5.9 million in ransom payments since late 2015, according to the most comprehensive report ever published on SamSam's activity, containing information since the ransomware's launch in late 2015 and up to attacks that have happened earlier this month.

Compiled by UK cyber-security firm Sophos, the 47-page report is a result of researchers collecting data from past attacks, talking to victims, and data-mining public and private sources for SamSam samples that might have slipped through the cracks.

Sophos notes that as time went by, the SamSam operators became more and more cautious, moving the ransom payment sites to the Dark Web and deploying more obfuscation for the SamSam code.
Click to expand...

47-page report (PDF): https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf

guest · Aug 3, 2018

The Week in Ransomware - August 3rd 2018 - Revenge of the Crab
August 03, 2018
https://www.bleepingcomputer.com/ne...nsomware-august-3rd-2018-revenge-of-the-crab/

This week was mostly small variants, but we did have some interesting news. First we had a in-depth look at the SamSam ransomware by Sophos that details the staggering amount of money they are generating. The other interesting story is the developers of the GandCrab ransomware getting revenge on AhnLab for creating a vaccine for their ransomware. In their attempt at revenge, the GandCrab developers included code that could possibly DDOS AhnLab Lite v3. [...]
Click to expand...

ronjor · Aug 6, 2018

Atlanta's Reported Ransomware Bill: Up to $17 Million

Mathew J. Schwartz (euroinfosec) • August 6, 2018
City Didn't Pay Ransom, But Spends for Cleanup, New Devices, Better Security
Click to expand...

Peter2150 · Aug 6, 2018

Bet a good back up system wouldn't have cost near that much.

guest · Aug 9, 2018

The PGA Possibly Infected With the BitPaymer Ransomware
August 08, 2018
https://www.bleepingcomputer.com/ne...sibly-infected-with-the-bitpaymer-ransomware/

According to a report from GolfWeek, computers at the PGA have been infected with ransomware. The victims learned they were infected on Tuesday when ransom notes started appearing on their screen.

"Your network has been penetrated," the ransom note read according to Golfweek's article. "All files on each host in the network have been encrypted with a strong algorythm [sic]."

Like SamSam, BitPaymer tends to target organizations by hacking into Remote Desktop Services connected to the Internet. Once inside a network, they traverse through it and encrypt every computer they can get access to.
Unfortunately, BitPaymer is a secure ransomware, which means either the PGA is going to have to restore from backup or pay a hefty ransom payment.
Click to expand...

Minimalist · Aug 10, 2018

The four most popular methods hackers use to spread ransomware

There are a number of attack vectors ransomware can exploit to take over computers or servers. These are the four most common ways ransomware infects its victims.
Click to expand...

https://www.itproportal.com/features/the-four-most-popular-methods-hackers-use-to-spread-ransomware/

guest · Aug 10, 2018

New KeyPass Ransomware Campaign Underway
August 10, 2018
https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/

A new distribution campaign is underway for a STOP Ransomware variant called KeyPass based on the amount of victims that have been seen. Unfortunately, how the ransomware is being distributed is unknown at this time.

Not much is known regarding how this ransomware is being distributed other than what people have posted in the BleepingComputer forums. According to some of the posts, the ransomware appeared after the user downloaded and installed cracks such as KMSpico. Other reports state that it appeared on its own and that the victim did not install anything.

Based on submissions to ID Ransomware there has been increased activity for this variant since the 8th with submissions from over 20 countries.
Click to expand...

Minimalist · Aug 11, 2018

The Week in Ransomware - August 10th 2018 - BitPaymer & KeyPass

This was a pretty quiet week with mostly small variants, one new active release, and a large organization getting hit.
Click to expand...

https://www.bleepingcomputer.com/ne...mware-august-10th-2018-bitpaymer-and-keypass/

guest · Aug 11, 2018

New Cmb Dharma Ransomware Variant Released
August 11, 2018
https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/

On Thursday a new variant of the Dharma Ransomware was discovered that appends the .cmb extension to encrypted files.

The Cmb variant of the Dharma Ransomware was first discovered by Michael Gillespie when he noticed samples uploaded to ID Ransomware, After tweeting about it, Jakub Kroustek replied with a hash to the sample.

It should be noted that this ransomware will encrypt mapped network drives, shared virtual machine host drives, and unmapped network shares. So it is important to make sure your network's shares are locked down so that only those who actually need access have permission.

Once again, at this time there is no way to decrypt files infected with the Dharma Cmb Ransomware variant for free.
Click to expand...

guest · Aug 13, 2018

mood said: ↑

New KeyPass Ransomware Campaign Underway
August 10, 2018
https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/
Click to expand...

KeyPass ransomware
August 13, 2018
https://securelist.com/keypass-ransomware/87412/

In the last few days, our anti-ransomware module has been detecting a new variant of malware – KeyPass ransomware. Others in the security community have also noticed that this ransomware began to actively spread in August

According to our information, the malware is propagated by means of fake installers that download the ransomware module.

From our point of view, the most interesting feature of the KeyPass Trojan is the ability to take ‘manual control’. The Trojan contains a form that is hidden by default, but which can be shown after pressing a special button on the keyboard. This capability might be an indication that the criminals behind the Trojan intend to use it in manual attacks.
Click to expand...

guest · Aug 15, 2018

Princess Evolution Ransomware is a RaaS With a Slick Payment Site
August 15, 2018
https://www.bleepingcomputer.com/ne...nsomware-is-a-raas-with-a-slick-payment-site/

A new variant of the Princess Locker ransomware is being distributed called Princess Evolution. Like its predecessor, Princess Evolution is a Ransomware as a Service, or RaaS, that is being promoted on underground criminal forums.

Unfortunately, at this time there is no known way to decrypt files encrypted by Princess Evolution.

According to a report by TrendMicro, the Princess Evolution ransomware has been seen being distributed through the RIG Exploit Kit. These exploit kits are installed on hacked sites and exploit vulnerabilities on visitor's computers to install the ransomware without their permission or even knowledge.
Click to expand...

guest · Aug 17, 2018

The Week in Ransomware - August 17th 2018 - Princess Evolution & Dharma
August 17, 2018
https://www.bleepingcomputer.com/ne...gust-17th-2018-princess-evolution-and-dharma/

The biggest news was the release of the Princess Evolution RaaS and a new variant of the Dharma ransomware utilizing the .cmb extension for encrypted files. Otherwise, it was mostly small variants released that will not likely have many victims.

Remember, while ransomware is not distributed as much through malspam, it is still a threat and being installed via more sneaky methods such as through remote desktop, exploit kits, and other malware. Therefore, continue to make sure those backups are working well and to have an updated security software installed. [...]
Click to expand...

guest · Aug 20, 2018

New Fox Ransomware Matrix Variant Tries Its Best to Close All File Handles
August 20, 2018
https://www.bleepingcomputer.com/ne...ant-tries-its-best-to-close-all-file-handles/

A new variant of the Matrix Ransomware has been discovered that is renaming encrypted files and then appending the .FOX extension to the file name. Of particular interest, this ransomware could have the most exhaustive process of making sure each and every file is not opened and available for encrypting. Thankfully, this also makes its encryption process very slow so it could be easier to detect.

This ransomware variant was first discovered by security researcher MalwareHunterTeam and is installed through computers running Remote Desktop Services and being openly connected to the Internet. The attackers will scan ranges of IP addresses to find open RDP services and then brute force the password.

Unfortunately, at this time the Matrix Ransomware variants cannot be decrypted for free.
Click to expand...

guest · Aug 21, 2018

Ryuk Ransomware Crew Makes $640,000 in Recent Activity Surge
August 21, 2018
https://www.bleepingcomputer.com/ne...-crew-makes-640-000-in-recent-activity-surge/

A new ransomware strain named Ryuk is making the rounds, and, according to current reports, the group behind it has already made over $640,000 worth of Bitcoin.

Attacks with this ransomware strain were first spotted last Monday, August 13, according to independent security researcher MalwareHunter, who first tweeted about this new threat.

"According to what we can see right now, it seems the attacks are targeted, i.e. a result of some manual compromise," Mark Lechtik, a Check Point security researcher, told Bleeping Computer in a private conversation today.
Ryuk has ties to Hermes, previously tied to North Korea
A report published today by cyber-security firm Check Point also points out that Ryuk may be the work of the same people who developed the Hermes ransomware —or at least someone who gained access to the Hermes ransomware source code.
Click to expand...

Minimalist · Aug 21, 2018

New Ransomware Family Appends ‘.Armage’ to Encrypted Files

Quick Heal Security Labs spotted the threat, dubbed “Armage,” spreading to users via spam emails and corrupted text files in late July.

Armage doesn’t drop additional executables to perform its malicious activity; instead, it relies on its mother file to alphabetically locate the first document for encryption using the Windows application programming interface (API) FindFirstFileA. It encrypts that file using the Advanced Encryption Standard 256-bit encryption (AES-256) algorithm, adds “.Armage” to the encrypted file and then searches for additional files in alphabetical order using the FindNextFileA API. Once it has encrypted all the files it can on an infected machine, it deletes the shadow volume copies and drops a ransom note called “Notice.txt” in all infected folders.
Click to expand...

https://securityintelligence.com/news/new-ransomware-family-appends-armage-to-encrypted-files/

guest · Aug 25, 2018

The Week in Ransomware - August 24th 2018 - Hermes, Fox, and Ryuk
August 25, 2018
https://www.bleepingcomputer.com/ne...somware-august-24th-2018-hermes-fox-and-ryuk/

This week we had seen quite a few campaigns that had widespread distribution. These campaigns are either being installed over accessible Remote Desktop Services or malspam. The biggest news is a variant of the Hermes ransomware called Ryuk that has generated over 600k USD for the developers. [...]
Click to expand...

guest · Aug 31, 2018

Cracking ransomware: RansomWarrior victims can now retrieve files for free
Researchers at Check Point examined this recent form of ransomware and found it relatively easy to crack.
August 31, 2018
https://www.zdnet.com/article/crack...rior-victims-can-now-retrieve-files-for-free/

Researchers at Check Point analysed RansomWarrior and found it to be the work of seemingly inexperienced attackers, and were able to retrieve the decryption keys from the malware.

The file-locking malware targets Microsoft Windows users and is delivered to victims via an executable named 'A Big Present.exe' which, if run, will encrypt files with a .THBEC extension.

Check Point succeeded due to the weak encryption used by the ransomware, which is a stream cipher that uses a key randomly generated from 1000 hard-coded keys in the RansomWarrior binary code.
Click to expand...

guest · Sep 1, 2018

CryptoNar Ransomware Discovered and Quickly Decrypted
August 31, 2018
https://www.bleepingcomputer.com/ne...-ransomware-discovered-and-quickly-decrypted/

This week a new CryptoJoker ransomware variant was discovered called CryptoNar that has infected victims. The good news, is that a free decryptor was quickly released so that these victims can get their files back for free.

This ransomware was first discovered by MalwareHunterTeam and at first glance it looks like a ransomware with little to no distribution. While I would normally not write about ransomware like these, it was later learned that this ransomware had encrypted close to 100 victims.
Free CryptoNar Decryptor created
The good news is that Michael Gillespie was able to create a free decryptor for CryptoNar that allows victims to get their files back for free.

Here's a free decrypter for CryptoJoker / CryptoNar [...] — Michael Gillespie (@demonslay335) August 28, 2018
Click to expand...

guest · Sep 1, 2018

The Week in Ransomware - August 31st 2018 - Devs on Vacation
August 31, 2018
https://www.bleepingcomputer.com/ne...ransomware-august-31st-2018-devs-on-vacation/

Even the ransomware developers seem to be taking a last minute summer vacation as it was only small variants released, with a few being in development. I am hoping this is just a continual decline in new ransomware, but we will not know for sure until we start moving into September.

For now, make sure that you have a working backup and that you do not have any computer running remote desktop services connected directly to the Internet. If you do, put them behind a firewall or you are just asking to get hacked. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Peter2150 Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Peter2150 Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches