Ransomware and Recent Variants

guest · Mar 30, 2019

Albany attacked by ransomware hack, mayor says
March 30, 2019
https://www.timesunion.com/news/article/City-of-Albany-attacked-by-ransomware-hack-13728996.php

Albany Mayor Kathy Sheehan on Saturday said in a social media post that the city experienced a ransomware cyber attack.

"We are currently determining the extent of the compromise. We are committed to keeping you informed and will provide updates as they become available," she tweeted.
Further details on the attack weren't immediately available, including any specific areas the attack targeted, what it means for city residents and employees, who is being called in to help fight the problem and when it could be resolved.

City spokesman Brian Shea, reached Saturday afternoon, declined to comment.
Click to expand...

guest · Mar 30, 2019

mood said: ↑

Taos schools resolving ransomware attack
March 21, 2019
https://taosnews.com/stories/taos-schools-resolving-ransomware-attack,55866
Click to expand...

Taos schools overcome ransomware attack on computers
March 28, 2019
https://www.taosnews.com/stories/taos-schools-overcome-ransomware-attack-on-computers,56019

Taos Municipal Schools have been working to resolve a ransomware attack that knocked out access to district digital services.

The district is currently working with forensics teams as well as the FBI to find the ones responsible for the attack.
While the attack itself caused an initial safety concern, Torrez was immediately worried about the future issues with security. After meeting with forensics and IT teams, Torrez said no personal information has been leaked.

"We are working diligently to restore full functionality to all systems and to investigate this incident as quickly as we possibly can," Torrez said in a release. "At this time, however, we cannot provide a precise timetable for the conclusion of those efforts."
Click to expand...

guest · Apr 1, 2019

vxCrypter Is the First Ransomware to Delete Duplicate Files
April 1, 2019
https://www.bleepingcomputer.com/ne...e-first-ransomware-to-delete-duplicate-files/

Last week I discovered a new ransomware called vxCrypter that was currently in development. It is a .NET ransomware and is based on an older ransomware that was never finished called vxLock.

When analyzing the ransomware, Gillespie noticed that the ransomware was keeping tracking of the SHA256 hashes of each file it encrypted. As the ransomware encrypted other files, if it encountered the same SHA256 hash, it would delete the file instead of decrypting it.
It should be noted that the ransomware is only deleting duplicate files for the following file extensions that it targets for encryption.

It is not known why the ransomware is doing this other than as a possible way to increase the speed of encrypting a computer. It also illustrates how we have to stay alert as attackers continue to evolve malware to increase performance, cause havok, or just do things for no obvious reason.
Click to expand...

guest · Apr 1, 2019

Mira Ransomware Decryptor
April 1, 2019
https://labsblog.f-secure.com/2019/04/01/mira-ransomware-decryptor/

We investigated some recent Ransomware called Mira (Trojan:W32/Ransomware.AN) in order to check if it’s feasible to decrypt the encrypted files.

Most often, decryption can be very challenging because of missing keys that are needed for decryption. However, in the case of Mira ransomware, it appends all information required to decrypt an encrypted file into the encrypted file itself. [...]
Decryption tool
You can download our decryption tool from here.
Click to expand...

guest · Apr 1, 2019

mood said: ↑

Albany attacked by ransomware hack, mayor says
March 30, 2019
https://www.timesunion.com/news/article/City-of-Albany-attacked-by-ransomware-hack-13728996.php
Click to expand...

City of Albany Hit in Ransomware Attack
Few details yet on the March 30 ransomware attack
April 1, 2019
https://www.darkreading.com/attacks-breaches/city-of-albany-hit-in-ransomware-attack/d/d-id/1334308

Albany Mayor Kathy Sheehan in a press briefing today said while some of the city's computers were down during the attack, no personal information appears to have been stolen, nor were emergency services dispatch affected.

City officials have provided few details on the attack, which began on March 30.
Read more here.
Click to expand...

guest · Apr 4, 2019

Emsisoft Decrypter for Planetary
April 4, 2019
https://decrypter.emsisoft.com/planetary

Planetary is a ransomware family that uses AES-256 to encrypt files, adding the extension ".mira", ".yum", ".Neptune", or ".Pluto" to files - the latter of which give this ransomware its name. The ransom note "!!!READ_IT!!!.txt" then asks the victim to contact [...]
Click to expand...

Download: https://decrypter.emsisoft.com/download/planetary

guest · Apr 5, 2019

Genesee County ransomware attack more severe than originally thought
April 5, 2019
https://www.scmagazine.com/home/sec...e-attack-more-severe-than-originally-thought/

Genesee County, Mich. officials are telling residents the ransomware attack it suffered has had a larger impact than originally thought and that many services are not likely to be quickly restored.

The county reported the attack to residents on April 2 on its Facebook page stating the attackers encrypted some files and demanded a ransom, which was not paid. At that time the county believed it had limited the extent of the damage and that its IT team would have most systems restored by the start of business on April 3 with the remainder coming online later that day.

This forecast proved overly optimistic and county officials followed up on April 4 with a second Facebook post.
“The scope of the attack on Genesee County has turned out to be more extensive than initially thought. While the encryption of data has occurred, the evidence continues to show that no data has been released,” was posted.
Click to expand...

EASTER · Apr 5, 2019

mood said: ↑

Genesee County ransomware attack more severe than originally thought
April 5, 2019
https://www.scmagazine.com/home/sec...e-attack-more-severe-than-originally-thought/
Click to expand...

Stuff is particularly crappy-One should never underestimate the exacting consequences of it (but they often still do) after it's made it's way inside of a Windows system.

guest · Apr 5, 2019

The Week in Ransomware - April 5th 2019 - Pacman Wakka Wakka
April 5, 2019
https://www.bleepingcomputer.com/ne...ransomware-april-5th-2019-pacman-wakka-wakka/

This week was marked by the release of a couple of decryptors as well as numerous variants of existing ransomware and new smaller variants. Strangely, someone released a Pacman themed ransomware.

Of particular interest is Norsk Hydro releasing a video documentary about the people who discovered that they were infected with the LockerGoga ransomware. Definitely an interesting and refreshing method that they are using to handle this security incident. [...]
Click to expand...

guest · Apr 11, 2019

City working to ID source of ransomware attack
April 11, 2019
http://www.reflector.com/News/2019/04/11/City-working-to-ID-source-of-ransomware-attack.html

The city of Greenville is prepared to go “a couple of days” with limited computer operations following a ransomware virus attack on Wednesday, a spokesman said.

“It’s ransomware. We have received a request for payment but that is all I can say at this point,” Letchworth said.
“The plan for IT is to gradually bring things back online as they try to figure out where it came from and what are options are,” he said.

Police and fire emergency communications are unaffected by the virus, Letchworth said. The Greenville Utilities Commission is not affected because its computer system is separate from the city’s, a GUC spokeswoman said.
The virus was discovered in the early morning hours by a member of the Greenville Police Department.
Click to expand...

guest · Apr 11, 2019

mood said: ↑

City of Albany Hit in Ransomware Attack
Few details yet on the March 30 ransomware attack
April 1, 2019
https://www.darkreading.com/attacks-breaches/city-of-albany-hit-in-ransomware-attack/d/d-id/1334308
Click to expand...

In Albany ransomware attack, officials say information was not compromised
April 11, 2019
https://statescoop.com/in-albany-ransomware-attack-officials-say-information-was-not-compromised/

Officials in Albany, New York, said Wednesday that no city information was compromised in the ransomware attack that struck its municipal government late last month.
“From the standpoint of mission critical data and information we feel confident that anything we need to recover, we’ll be able to recover,” Sheehan said at a news conference.

Still, details on the attack remain sparse.
While the update Sheehan and McEneny gave Wednesday sheds some light, it’s becoming increasingly common for ransomware victims, especially government organizations, to be withholding [...]
“Maybe there are tactical reasons,” MacCellan said, suggesting that local governments hit by ransomware might be “coached” by state or federal law enforcement agencies to disclose fewer details. “Why give up anything someone else could replicate?”
Click to expand...

guest · Apr 12, 2019

Emsisoft Decrypter for CryptoPokemon
April 11, 2019
https://decrypter.emsisoft.com/cryptopokemon

CryptoPokemon uses SHA256 and AES-128 to capture victim's files, and adds the extension ".CRYPTOPOKEMON". The victim is then presented a ransom note and website claiming to be "PokemonGO". The ransom note "!INFO.CRYPTOPOKEMON.log" text can be found below: [...]
Click to expand...

Download: https://decrypter.emsisoft.com/download/cryptopokemon

Emsisoft blog entry: Emsisoft used decrypter on CryptoPokemon ransomware… It’s super effective!

First discovered by IntezerLabs, CryptoPokemon is a new strain of ransomware that encrypts your files and demands a payment of 0.02 Bitcoin (about $104 at the time of writing) to decrypt them.

After CryptoPokemon was brought to our attention, Emsisoft security experts were able to find a flaw in the ransomware’s code and create a decrypter that allows you to decrypt your files without paying a cent. [...]
Click to expand...

guest · Apr 12, 2019

Looking Into Anatova Ransomware
April 11, 2019
https://www.fortinet.com/blog/threat-research/looking-into-anatova-ransomware.html

Anatova ransomware is a 64-bit malware that is currently running in the wild. It is very seldom that the researchers here at FortiGuard Labs get to see pure 64-bit ransomware, due to the fact that there are still lots of 32-bit machines that are in operation. [...]
Wrap Up
Anatova is a fairly new ransomware. It avoids infecting computers that are used in analysis and research labs. It systematically avoids infecting files and folders that are important to the stability of the computer system it is infecting.
Another noticeable difference of Anatova from other ransomware is that it does not change the extension names of encrypted files.

Although it does not have a very loud visible ransom note, it is getting attention on the choices of the running process that it wants to terminate. Terminating the processes in its list can trigger suspicion in the part of the user.
The thing that sets this particular ransomware apart is that it is wise enough to clean its trails and remove any possible restoration of the system.
Click to expand...

guest · Apr 12, 2019

Garfield County, Utah falls victim to ransomware, pays attackers
April 12, 2019
https://www.scmagazine.com/home/sec...ah-falls-victim-to-ransomware-pays-attackers/

Garfield County, Utah became the latest municipality to not only be hit with a ransomware attack, but succumb to the attackers demand and pay the ransom.

Local news reports said the attack happened several weeks ago, but proved so severe that the county opted to pay for the release of its files. The payment was made in bitcoin and the files were released in March. The county did not state how much was paid to the attackers.
“All of our data had been taken,” Garfield County Attorney Barry Huntington told Fox13Now.
The attack was launched via a phishing email resulting in the county’s data being encrypted, although some officials told Fox13now that the data from the assessor’s office and the recorder’s office had also been removed.
Click to expand...

guest · Apr 12, 2019

The Week in Ransomware - April 12th 2019 - Targeting Reveton
April 12, 2019
https://www.bleepingcomputer.com/ne...ransomware-april-12th-2019-targeting-reveton/

Been a busy week with a few decryptors released, lots of variants of existing ransomware released, and a few in-developments ones discovered.

The biggest news was the announcement that the UK has jailed one of the distributors of the Reveton ransomware. This ransomware was a plague in 2012 through 2015 where it would lock out users from their computer while pretending to be a notice from a government law enforcement agency.

For this reason, this type of ransomware was commonly called a Police Trojan. You can see a few examples of their lockscreens here. [...]
Click to expand...

guest · Apr 13, 2019

mood said: ↑

City working to ID source of ransomware attack
April 11, 2019
http://www.reflector.com/News/2019/04/11/City-working-to-ID-source-of-ransomware-attack.html
Click to expand...

City of Greenville hit by RobbinHood:
RobbinHood Ransomware Claims It's Protecting Your Privacy
April 13, 2019
https://www.bleepingcomputer.com/ne...ansomware-claims-its-protecting-your-privacy/

A new ransomware is in play called RobbinHood that is targeting entire networks and then encrypting all computers that they can gain access to. They then request a certain amount of bitcoins to decrypt a single computer or a larger amount to decrypt the entire network.

Not much is currently known about this ransomware and a sample for RobbinHood has not currently been found. We have, though, seen the ransom notes and encrypted files of various victims, which allows us to put together a picture of how this ransomware may operate.
Of particular interest is how they stress that the victim's privacy is important to them and they will not disclose any victims who have paid.
RobbinHood cares about your privacy
On the ransomware's Tor payment page, the developers of RobbinHood state that they care about their victim's privacy and that the encryption keys and IP addresses will be deleted after payment.
Click to expand...

xxJackxx · Apr 15, 2019

Maybe if/when they identify a couple of these ramsomware groups they should send in the military. That might slow things down.

Trooper · Apr 15, 2019

xxJackxx said: ↑

Maybe if/when they identify a couple of these ramsomware groups they should send in the military. That might slow things down.
Click to expand...

I've had similar thoughts in the past myself.

guest · Apr 16, 2019

Threat actors gaining admin rights before ransomware infections
April 15, 2019
https://www.scmagazine.com/home/sec...leges-and-using-custom-notes-with-ransomware/

Threat actors are using accounts with admin privileges to install BitPaymer ransomware via PsExec suggesting threat actors are taking a more targeted approach to their distribution of malware.

“BitPaymer, which is related to the iEncrypt ransomware, was executed in the manufacturing company’s system using PsExec,” researchers said in an April 15 blog post. “Our analysis revealed that on February 18, 2019 PST, between 9:40 p.m. and 11:03 p.m., commands were sent via PsExec to copy and execute the BitPaymer variant.”

Between January 29 to February 18 threat actors attempted multiple attempts to run an Empire PowerShell backdoor on several of the machines that were detected by researchers.
It’s possible that one of these attacks resulted in a security breach that took place before the ransomware was installed since researchers said that the attacker needed at least one account with administrative privileges in order to run the commands.
Click to expand...

guest · Apr 16, 2019

Ransomware-raided Aussie businesses pay up
Majority get their data back
April 16, 2019
https://www.itnews.com.au/news/ransomware-raided-aussie-businesses-pay-up-523952

Telstra's 2019 security survey claims 51 per cent of Australian respondents that were attacked by ransomware paid up, and 79 per cent would do it again if they did not have backups available.

A third of Australian respondents said they had had their businesses being interrupted on a weekly or monthly basis by ransomware attacks, a higher proportion than in European countries.
More than nine out of then Kiwi businesses surveyed by Telstra say they were struck by ransomware attacks, compared to four-fifths of Australian organisations.

The hard-hit Kiwis are keener to pay ransomware raiders than Australians, with 61 per cent stumping up money for the extortionists to get their files back.
Click to expand...

guest · Apr 16, 2019

'NamPoHyu Virus' Ransomware Targets Remote Samba Servers
April 16, 2019
https://www.bleepingcomputer.com/ne...irus-ransomware-targets-remote-samba-servers/

A new ransomware family called NamPoHyu Virus or MegaLocker Virus is targeting victims a bit differently than other ransomware. Instead of an executable running on a victim's computer, the attacker is running the ransomware locally and having it remotely encrypt accessible Samba servers.

This new ransomware is doing things differently by searching for accessible Samba servers, brute forcing the passwords, and then remotely encrypting their files and creating ransom notes.
Unfortunately, there are plenty of targets, as Shodan shows close to 500,000 accessible Samba servers.
MegaLocker Virus first spotted in March 2019
Reports of this ransomware first started in March 2019, where users stated that their NAS storage devices were suddenly encrypted by a ransomware called MegaLocker Virus.
Changed to NamPoHyu Virus in April
In early April 2019, users began reporting on BleepingComputer that the ransomware switched its name to the NamPoHyu Virus and started appending the .NamPoHyu extension to encrypted files.
Click to expand...

guest · Apr 18, 2019

DLL Cryptomix Ransomware Variant Installed Via Remote Desktop
April 18, 2019
https://www.bleepingcomputer.com/ne...somware-variant-installed-via-remote-desktop/

The CryptoMix ransomware is still alive and kicking as a new variant has been spotted being spread in the wild. This new version appends the .DLL extension to encrypted files and is said to be installed through hacked remote desktop services.

This variant was first reported in a topic in our forums where a victim stated that they were infected by the attackers hacking into their publicly exposed remote desktop services. According to the victim, the ransomware had also enabled the default administrator account and changed its password.
Unfortunately, at this time the ransomware cannot be decrypted for free. As this is just a cursory analysis of this new variant, if anything else is discovered, we will be sure to update this article.
Click to expand...

ronjor · Apr 18, 2019

Report: Cryptocurrency ransomware payments up 90%, thanks to Ryuk

Story by Matthew Beedham April 18, 2019
Ransomware attacks are still doing the rounds and one in particular appears to be gaining pace.
Cryptocurrency payments made to ransomware attackers increased nearly 90 percent in Q1 2019 over the previous quarter, according to ransomware support firm Coveware’s latest report
Click to expand...

guest · Apr 18, 2019

City of Augusta hit by computer virus, City Center closed
April 18, 2019
https://www.sunjournal.com/2019/04/18/city-of-augusta-hit-by-computer-virus-city-center-closed/

A malicious computer virus that hit the city overnight and froze the city’s computer network forced the closure of Augusta City Center Thursday.

The virus, which officials said was intentionally inflicted upon the city’s servers, also shut down computers used by public safety dispatchers — but not the city’s phone system or the public safety radio system relied upon for dispatchers, police, fire and ambulance staff in the field to communicate.
“All our servers are locked up,” St. Pierre said. “This was a particularly bad (virus). This one exploded, it got all the data, all the servers, they froze rock solid and you can’t pierce it. It’s pretty widespread and impactful.”

“[...] it was a locking down of the data [...] This was intentional. We just haven’t gotten, from IT, what the ransom demand might be yet.”
He said the city’s email server is at the school department and is still up and running, so city staff with smartphones can still respond to email.
Click to expand...

guest · Apr 19, 2019

The Week in Ransomware - April 19th 2019 - RobbinHood, Samba, and More
April 19, 2019
https://www.bleepingcomputer.com/ne...re-april-19th-2019-robbinhood-samba-and-more/

This week introduced a new ransomware player that is targeting companies called RobbinHood. This ransomware recently took down the City of Greenville's computer systems and offers two different ransom payments; a price per computer or one for the entire network.
We also saw a new ransomware called NamPoHyu that is targeting remote Samba servers and encrypting their data remotely. Otherwise, it's mostly been new variants of older ransomware. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

xxJackxx Registered Member

Trooper Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

xxJackxx Registered Member

Trooper Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Useful Searches