Ransomware and Recent Variants

guest · Jul 26, 2019

Local governments are still woefully unprepared to fight ransomware
July 25, 2019
https://www.engadget.com/2019/07/26...e-still-woefully-unprepared-to-fight-ransomw/

Our state and local governments found themselves under siege in 2019 from William Plunketts for the internet age. But rather than pistols and roadblocks, this new generation of bandits come armed with encryption algorithms and demands for bitcoin.

These attacks aren't particularly effective and the likelihood of receiving payment from a target varies widely, which is part of the reason that perpetrators have stopped fiddling around with individual marks and largely moved onto bigger prey like hospitals, universities, and government agencies.
Baltimore, Maryland has been especially hard hit. The city's 911 and 311 systems were knocked offline in 2018 due to a ransomware attack, then a majority of the city's servers were infected this May.

As Akshay Bhargava, SVP of Malwarebytes, points out that part of the overall increase in attacks stems from the ease of entry into the space. While it's no longer a case of simply hopping on an illicit IRQ channel and trading malware code as script kiddies did throughout the early 2000's, "it's easier for smaller actors to participate," he told Engadget.
Click to expand...

guest · Jul 26, 2019

Baltimore approves $10 million for ransomware recovery
July 26, 2019
https://statescoop.com/baltimore-city-council-approves-10-million-ransomware-recovery/

The Baltimore City Council’s budget committee approved $10 million in spending Thursday to cover the ongoing costs of the city’s recovery from a ransomware attack that disabled IT systems throughout the city government.

The unanimous vote represented the first step in paying the bills associated with regaining access to encrypted files and upgrading compromised computers in the wake of a cyberattack that has hamstrung the city’s operations since early May.
The full council is expected to approve the $10 million outlay next month, though more than half of that sum has already been spent on cybersecurity consultants, new equipment and staff overtime, according to a fact sheet on the city’s website.
Click to expand...

guest · Jul 26, 2019

The Week in Ransomware - July 26th 2019 - State of Emergency
July 26, 2019
https://www.bleepingcomputer.com/ne...ransomware-july-26th-2019-state-of-emergency/

Now that ransomware developers know that they can earn monstrous payouts from local cities and insurance policies, we see a new government agency, school district, or large company getting hit with a ransomware attack every day.
For example, this week the Governor of Louisiana declared a state of emergency for the wave of attacks targeting school districts in the state.

Sodinokibi also continues to rear its head this week with a new campaign where they were impersonating Germany's BSI. Otherwise, it has been a steady stream of new variants of existing ransomware and a smattering of new lower end families being discovered.
The good news is that a decryptor for the LooCipher Ransomware was released, which allows those victims to recover their files for free. [...]
Click to expand...

guest · Jul 26, 2019

Schools Targeted by Hackers
Wallingford, Pomfret and New Haven schools are all dealing with the aftermath of ransomware attacks on their systems
July 25, 2019
https://www.nbcconnecticut.com/news/local/Schools-Targeted-by-Hackers-513210741.html

Three Connecticut schools have been targeted by ransomware attacks.
In two of the cases student and staff information was accessed, though officials in those districts say there is no evidence that it was misused.

None of the school districts have said whether they paid a ransom to get their information back, but Kudelchuk said that larger organizations like school systems often have a back-up that can be used to regenerate their network.
“It’s really scary. It’s very personal information,” said Ibtihal Anbar, a Wallingford mother who has two students entering school in the district this year.

Kudelchuk said schools are vulnerable because there are so many different users on their network from staff to students who often go outside the network. He added that cash-strapped school districts are often easy targets.
“Based on budget they may not have the latest and greatest security,” he pointed out.
Click to expand...

guest · Jul 26, 2019

mood said: ↑

Schools Targeted by Hackers
Wallingford [...]
Click to expand...

Data Breach Affects Wallingford Students
July 26, 2019
https://patch.com/connecticut/wallingford/data-breach-affects-wallingford-students

A third-party security breach exposed the personal information of some Wallingford students. Pearson Clinical Assessment notified the school district that names, dates of birth and email addresses were exposed for a limited number of students.
The breach didn't expose Social Security numbers or assessment information, the school district said in a release.
Click to expand...

guest · Jul 27, 2019

Eastern Ontario municipality suffered from a ransomware attack
July 26, 2019
https://www.spamfighter.com/News-22...ipality-suffered-from-a-ransomware-attack.htm

A municipality of eastern Ontario suffered from a ransomware attack in the latter part of last month (i.e. in June 2019), which affected all of their services. The Nation, an eastern Ontario municipality near Casselman, suffered the attack on a Sunday (i.e. June 30, 2019), as per a statement on their website.

The computer networks of the municipality were accessed illegally, and got infected with ransomware. Then the ransomware encrypted computer system, rendering several programs, including the email system of the municipality, unusable.
Even though the investigation is yet to be concluded, the authorities believe that the hackers have not accessed the data that was compromised during this incident.

The hackers demanded the ransom payment between $7,000 and $10,000 in bitcoin, however the municipality has refused to comply with attackers' demands and carry out this recovery process on their own.

Amour said "we have to learn from what happened. Most of our servers at nighttime will be shut-down, and it's going to a more rigorous logging-in process. It's going to inconvenience most of the users, but that's what you have to do to have higher security".
Click to expand...

guest · Jul 28, 2019

mood said: ↑

Syracuse schools’ cyber attack is ransomware
July 12, 2019
https://www.syracuse.com/news/2019/07/syracuse-schools-cyber-attack-is-ransomware.html
Click to expand...

Syracuse ransomware attack: School district expects to pay $50,000, insurance pays rest
July 26, 2019
https://www.syracuse.com/schools/20...expects-to-pay-50000-insurance-pays-rest.html

The Syracuse City School District expects to pay a $50,000 insurance deductible to restore its computer system which was hit by a ransomware attack more than two weeks ago.

The district did not say if the insurance carrier paid a ransom to attackers.

“We expect the cyber insurance policy to cover the costs of this incident, subject to a $50,000 deductible,” the district said in a five-paragraph statement. District officials did not respond to any questions.
The district did not reveal the entire cost of the incident.

Superintendent Jaime Alicea and most members of the city’s school board have not returned phone calls from Syracuse.com seeking comment on the issue. Syracuse Mayor Ben Walsh declined to comment when asked if the district paid a ransom and deferred questions to the school district.
Click to expand...

Onondaga County library waives late fees because of ransomware attack

The Onondaga County Public Library system was hit by a similar attack July 12 which disabled its computer system. The county never received a ransom demand, according to county spokesman Justin Sayles.
The library system appears to be recovering from the attack slower than the school district.
While the district’s system has been largely restored, much of the library’s system is still down.

The library has waived late fees for overdue books because returned items cannot be checked back into its computer system. Library users cannot renew books, place holds on items, access library databases or get their accounts updated.
Click to expand...

guest · Jul 29, 2019

Hackers’ Latest Target: School Districts
July 28, 2019
https://www.nytimes.com/2019/07/28/us/hacker-school-cybersecurity.html

Some hackers demand ransom; others sweep up personal data for sale to identity thieves. But whatever hackers’ motives, school systems around the country have been the targets of their cyberattacks.

Many public institutions, including hospitals, local governments and colleges, have been hit with ransomware attacks in recent years, but school districts have proved particularly enticing to hackers because they hold troves of private data and often lack the resources to fend off intruders.
Cybersecurity “is a tremendously growing concern for school districts,” Mr. Krueger said, adding that members of his organization now rank it in annual surveys as their top source of anxiety.

Ms. Stephens said local and state governments around the United States are realizing that “this is the next area of concern for government infrastructure.”
Click to expand...

guest · Jul 29, 2019

mood said: ↑

Outage has now reached a week
https://www.zdnet.com/article/cloud-based-virtual-desktop-provider-hit-by-ransomware/

iNSYNQ: Update: We're Beginning To Turn On Customer Desktops
Click to expand...

Update: Ongoing And Significant Progress

Update on 7/27 at 7:30am: 96 percent of iNSYNQ customers are back on their desktops, and we're working as quickly as possible to get the remaining four percent over the finish line.
This isn't a matter of prioritization. You all are important to us, and we are getting you all up as quickly as we can.

Here’s what customers can can expect once they are able to login:
While we caught the attack early, the malware was able to encrypt some files – in other words, disabling your ability to open them. With that said, almost no QuickBooks or Sage files have been corrupted. The vast majority of those impacted are small Microsoft Word, Excel, or PowerPoint files.
[...]
Click to expand...

guest · Jul 29, 2019

Possible second cyber attack crippling another Mobile company
July 26, 2019
https://mynbc15.com/news/local/possible-second-cyber-attack-crippling-another-local-company

NBC 15 has been alerted about a second possible cyber-attack crippling another local company.
Now an employee at a big steel plant in axis tells NBC 15 they are targeted too.

An employee from Blastech Mobile says hackers came after them last week. Now, they claim nothing is getting blasted at the plant except paychecks.

“We are not able to process or do anything, paint the steel blast the steel, anything basically.”
“They actually told us we’ve been cyber attacked and somebody has money held over our CEO’s head,” they said, adding “I don’t know the exact amount but it’s in the millions for them to get the system back.”
Click to expand...

Minimalist · Jul 29, 2019

Android ransomware is back

After two years of decline in Android ransomware, a new family has emerged. We have seen the ransomware, detected by ESET Mobile Security as Android/Filecoder.C, distributed via various online forums. Using victims’ contact lists, it spreads further via SMS with malicious links. Due to narrow targeting and flaws in both execution of the campaign and implementation of its encryption, the impact of this new ransomware is limited. However, if the developers fix the flaws and the operators start targeting broader groups of users, the Android/Filecoder.C ransomware could become a serious threat.
Click to expand...

https://www.welivesecurity.com/2019/07/29/android-ransomware-back/

guest · Jul 29, 2019

Server hack delays Houston County Schools’ start date
July 25, 2019
https://www.dothaneagle.com/news/ed...cle_6e28738c-af06-11e9-bbf0-13920c892c35.html

Houston County Schools is postponing the school start date several days to Monday, Aug. 5.
The reason, Superintendent David Sewell confirmed, is an apparent malware attack of the school system's servers that has affected telecommunications and computer functionality school-wide.

"We have people working hard to re-install everything and bring everything back up to speed and get back to normal," he said at a press conference on Thursday.
Phone service at central office has been down since Wednesday and it is unclear when it will be back up and running. At this time, it is unclear to what extent the malware has affected the school system's servers.
Click to expand...

Officials can't confirm county school system hack isn't ransomware (July 26, 2019)

Mystery surrounds the malware attack on Houston County School servers, which officials could not confirm involves ransomware, through which hackers hold data hostage for a demanded ransom.

Superintendent David Sewell said that teachers’ computers may not be available for use by the school start date, which has been delayed to Monday, Aug. 5, four days later than the original Aug. 1 start date.

“More than likely, teachers will have to take roll the old-fashioned way – with pen and paper,” Sewell said.
"Upon advisement of counsel and law enforcement, we are unable to provide further information at this time," Sewell said in a statement.
Click to expand...

guest · Jul 29, 2019

Georgia State Patrol agency infected with ransomware
July 29, 2019
https://www.scmagazine.com/home/sec...state-patrol-agency-infected-with-ransomware/

The Georgia State Patrol was reportedly the target of a July 26 ransomware attack that has necessitated the precautionary shutdown of its servers and network.
Per local news affiliate WHNT, the GSP has confirmed that the incidence could slightly impact response times; however, members of the force still have other channels of communication such as radio dispatch to perform their duties and coordinate responses to accidents and other events. A separate report by WGCL said the public should see “little to no” direct effect.

“They just had a message pop up on their screen that looked a little strange from our headquarters office,” said GSP Lt. Stephanie Stallings, according to a joint WGCL/CNN news report. [...] as a preemptive action, they shut down the servers and shut down the network” to isolate the problem and ensure it’s not more widespread.
Click to expand...

guest · Jul 29, 2019

Attackers Are Wiping Iomega NAS Devices, Leaving Ransom Notes
July 29, 2019
https://www.bleepingcomputer.com/ne...ping-iomega-nas-devices-leaving-ransom-notes/

In a topic in the BleepingComputer forums, users are reporting that all of the files on their Lenovo Iomega NAS devices have been deleted or hidden and a ransom note was left in their place.
From the ransom notes seen by BleepingComputer, they are being created with different ransom amounts and messages. The most common message is that the user must pay 0.01 to 0.05 bitcoins to the specified address or the files "will be gone for good".
Files are deleted, but can be recovered
In conversations with victims, BleepingComputer has learned that the files are being deleted rather than encrypted and hidden somewhere on the drive.
As these are NAS devices with ext2 filesystems, some users have reported difficulty using file recovery software to work with the NAS devices.

One victim, though, has told BleepingComputer that they have had success using file recovery software after attaching the NAS device to their PC via a USB port.
Possibly gaining access via web interface
It is not clear how attackers are gaining access to the victim's devices, but searches on Shodan show numerous Iomega NAS devices connected directly to the Internet.
Click to expand...

guest · Jul 30, 2019

MegaCortex Returns…
July 30, 2019
https://blogs.quickheal.com/megacortex-returns/

MegaCortex, a ransomware which was first spotted in January this year, has become active again and has changed the way it previously attacked/targeted the corporate world. In order to simplify its execution and increase its scale of operation, it uses ‘Command Prompt’ instead of ‘PowerShell’ in current targeted campaign.
[...]
It is clearly seen that the attacker is no more ready to negotiate with the victims. Further they do not give any instructions as to how to buy bitcoins and asks the victim to Google the process. Also, they mention that they have attacked the system for profits and not to do any sort of charity.
Most ransom notes walk you through the payment process and even show a lot of sympathy with the victim. But the attacker has an aggressive outlook towards the victim!
Click to expand...

guest · Jul 30, 2019

mood said: ↑

Ransomware attack hinders library for second time
July 17, 2019
https://www.owensborotimes.com/feat...mware-attack-hinders-library-for-second-time/
Click to expand...

IT experts from Dallas, Bowling Green assist DCPL with ongoing ransomware attack
July 29, 2019
https://www.owensborotimes.com/feat...n-assist-dcpl-with-ongoing-ransomware-attack/

Daviess County Public Library is still experiencing the effects of a ransomware attack that first targeted the facility in April. The ransomware attack has limited access to some of DCPL’s computers at least twice in three months because the original issue was not fully resolved.

So, why would a public library be targeted for an ongoing ransomware attack? According to DCPS Director Erin Waller, this type of incident isn’t uncommon for libraries and other small, government-run agencies.
“Not specifically us, but entities like us,” she said. “Smaller governmental entities with a network setup like ours.”

For now, all operations at DCPL are running smoothly with the exception of the at-home catalog, library patron account access and the library’s self-check system.
The three-month ransomware attack has been a stressful experience for all involved, Waller said.
Click to expand...

Minimalist · Jul 30, 2019

Going down the ransomware rabbithole

Looking for insights in modern literature to address the challenges facing CISOs might seem farfetched, but there is some logic to this. Lewis Carroll’s Alice’s Adventures in Wonderland and Through the Looking Glass illustrates the challenges posed by ransomware. While this might seem contradictory on the surface, the options and twisted logic Alice faced are eerily similar to those posed by this pernicious malware.
Click to expand...

https://www.scmagazine.com/home/security-news/going-down-the-ransomware-rabbithole/

Peter2150 · Jul 30, 2019

It really would be cheaper in the long run to prevent it and have good, tested backups

guest · Jul 31, 2019

Gadsen Independent School District receives ransomware attack
July 31, 2019
https://kfoxtv.com/news/local/gadsen-isd-receives-ransomware-attack

Officials with the Gadsden Independent School District said a ransomware attack was sent to the district and the ransomware managed to encrypt the district's servers and domain controllers, which affected computers.
The district’s email service was shut down on July 16.

The GISD technology department worked on restoring the email service and other issues. The new email system was created and restored on July 25.
All district computers have computer virus protection software installed, according to Superintendent Travis Dempsey.
Click to expand...

guest · Aug 1, 2019

Lodi, Calif., Confirms Ransomware Behind Computer Troubles
July 31, 2019
https://www.govtech.com/security/Lodi-Calif-Confirms-Ransomware-Behind-Computer-Troubles.html

Lodi City Manager Steve Schwabauer has confirmed that the computer issue that hindered the city’s phone lines and data financial data systems earlier this year was, in fact, a ransomware attack.

After a staff member clicked on the attachment, the malware was spread through the city’s network of computers. It encrypted critical files that knocked several key phone lines out of service, including the non-emergency number for the Lodi Police Department, the emergency outage line for Public Works, and the main numbers for City Hall and the finance division.

“The ransom demanded 75 Bitcoins (approximately $400,000 at the time of the inquiry) be paid to restore our systems. We did not pay the ransom. Instead, we rebuilt our systems from our back-ups,” Schwabauer said.
“I have to say from my perspective, ransomware attacks were not high on my radar as city manager because there were only a few cities that this had affected, but our IT staff had their eye on it,” Schwabauer said.
Click to expand...

guest · Aug 2, 2019

GermanWiper ransomware hits Germany hard, destroys files, asks for ransom
Users advised not to pay the ransom under any circumstances!
August 2, 2019
https://www.zdnet.com/article/germa...-germany-hard-destroys-files-asks-for-ransom/

For the past week, a new ransomware strain has been wreaking havoc across Germany. Named GermanWiper, this ransomware doesn't encrypt files but instead it rewrites their content with zeroes, permanently destroying users' data.
As a result, any users who get infected by this ransomware should be aware that paying the ransom demand will not help them recover their files.
PRETTY BIG DISTRIBUTION CAMPAIGN
First signs of GermanWiper were reported earlier this week when victims started asking for help on the Bleeping Computer forums, a popular place where internet users congregate to get advice in dealing with ransomware infections.
The first report came on Tuesday, July 30, and they kept piling on through the following days.
DISTRIBUTED VIA MALSPAM
According to German security researcher Marius Genheimer and CERT-Bund, Germany's Computer Emergency Response Team, the GermanWiper ransomware is currently being distributed via malicious email spam (malspam) campaigns.
Click to expand...

guest · Aug 3, 2019

mood said: ↑

Ransomware crooks hit Synology NAS devices with brute-force password attacks
Password-guessing attacks against Synology NAS devices deliver a ransomware payload
July 26, 2019
https://www.zdnet.com/article/ranso...as-devices-with-brute-force-password-attacks/
Click to expand...

Threat Actors Utilizing eCh0raix Ransomware Change NAS Targeting
August 1, 2019
https://www.anomali.com/blog/threat-actors-utilizing-ech0raix-ransomware-change-nas-targeting

On July 23, 2019, Synology Inc., a Taiwan-based Network Attached Storage (NAS) company, posted an advisory on safeguarding internet-connected Synology NAS devices from Ransomware attacks.
Analysis
We believe that this attack against Synology users was conducted by the same actor behind the eCh0raix ransomware targeting QNAP NAS devices, as reported on July 10, 2019. This conclusion was based on code similarity, ransom amount, and shared strings.

The threat actors behind these attacks will likely continue their malicious activity because the large amount of NAS devices connected to the internet presents a large target pool. Furthermore, NAS devices are sometimes the final backup for companies or individuals, therefore, actors have more leverage when demanding ransom.
Click to expand...

guest · Aug 3, 2019

Ransomware hits school district outside Tulsa, Oklahoma
August 2, 2019
https://edscoop.com/ransomware-hits-school-district-outside-tulsa-oklahoma/

A school district in northeastern Oklahoma has become the latest victim in a growing trend of ransomware attacks targeting schools, universities and local governments.

Administrators of Broken Arrow Public Schools, a Pre-K-12 district of 27 schools outside Tulsa, published a notice on its website Thursday notifying parents it had “recently been experiencing network and server issues,” and that it had confirmed that a ransomware attack was the root cause of the service interruption.
Neither the type of ransomware nor the ransom amount have been disclosed.
Click to expand...

guest · Aug 3, 2019

mood said: ↑

Vigo County targeted in malware assault on computers
July 23, 2019
https://www.wthr.com/article/vigo-county-targeted-malware-assault-computers
Click to expand...

Vigo County, Ind., 95 Percent Operational After Cyberattack
August 2, 2019
https://www.govtech.com/security/Vigo-County-Ind-95-Percent-Operational-After-Cyberattack.html

Overall, Vigo County's computer system was perhaps 95 percent up and running on Thursday, nine days after being hit with a ransomware attack, according to the county's tech director.

"[The FBI] are putting together information in the back end to see if it relates to similar attacks of this nature," Snowden said, adding it is standard protocol to contact the FBI and others, including the Indiana Secretary of State's office, after such an attack.
"It is analytics, like bread crumbs. They [FBI] are trying to see commonalities and see if it is similar to other ransomware attacks," he said, adding the county does not know the source of the attack.
Click to expand...

guest · Aug 3, 2019

The Week in Ransomware - August 2nd 2019 - More of the Same
August 3, 2019
https://www.bleepingcomputer.com/ne...-ransomware-august-2nd-2019-more-of-the-same/

This week the biggest news was attackers breaking into Iomega NAS devices, wiping the drives, and then leaving ransom notes. It is not known if any users were able to recover their files after paying the ransom.

We also had a new Android ransomware that was using infected phones to spread itself other victims via SMS texts.
Otherwise, it has mostly been new variants of existing ransomware families. [...]
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Peter2150 Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Peter2150 Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches