Ransomware and Recent Variants

guest · Aug 4, 2019

Preparing for Ransomware Attacks
August 2, 2019
https://lifars.com/2019/08/preparing-for-ransomware-attacks/

There is a possibility that anyone can be a target of a ransomware attack. The frequency of attacks is due to people using unsecure devices.

One way to prepare is by having backups of all files and assets that cannot be lost or that the company needs to function. Backups of the files should not be stored on the main system to avoid being compromised in the ransomware attack.
Computer software needs to stay up to date. Issuing updates fixes bugs that a hacker could exploit for different cyber-attacks like ransomware.

Also, employees should be taught to be wary of spam and attachments due to hackers sending ransomware this way. People should be wary to open emails from people that they do not know or that doesn’t look right since those emails could be infected with malware or send the victim to a page that is.
Click to expand...

guest · Aug 5, 2019

Sodinokibi: The Crown Prince of Ransomware
August 5, 2019
https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack

In April of 2019, the Cybereason Nocturnus team encountered and analyzed a new type of ransomware dubbed Sodinokibi. Sobinokibi is highly evasive, and takes many measures to prevent its detection by antivirus and other means. [...]
CONCLUSION
In this blog, we took a deep dive into the Sodinokibi ransomware infection process, and showed that even though the obfuscation techniques used by the ransomware authors are quite simple, they are still proving to be very effective in bypassing most antivirus vendors.

Our analysis further supports the suspicion that the threat actors behind the Sodinokibi ransomware are the same allegedly retired authors who created the GandCrab ransomware, based on findings detailed in this report, such as: similarities in the language and countries whitelist (Russian-speaking countries and even Syrian Arabic), the “revengeful” targeting of an Ahnlab product for process injection, and the similarities in the URL-generation routine.
Click to expand...

guest · Aug 5, 2019

mood said: ↑

MegaCortex Returns…
July 30, 2019
https://blogs.quickheal.com/megacortex-returns/
Click to expand...

New version of MegaCortex targets business disruption
August 5, 2019
https://www.accenture.com/us-en/blogs/blogs-megacortex-business-disruption

iDefense engineers have identified and analyzed a recently updated version of the dangerous ransomware MegaCortex, which is known to have previously caused costly incidents across various industries in Europe and North America.

The authors of MegaCortex v2 have redesigned the ransomware to self-execute and removed the password requirement for installation; the password is now hard-coded in the binary.
Additionally, the authors also incorporated some anti-analysis features within the main malware module, and the functionality to stop and kill a wide range of security products and services; this task was previously manually executed as batch script files on each host.

The original version of MegaCortex had its main payload protected by a custom password that was only available during a live infection. As a result, this feature made the malware difficult for security vendors to analyze.
The changes in Version 2 suggest that the malware authors traded some security for ease of use and automation. With a hard-coded password and the addition of an anti-analysis component, third parties or affiliated actors could, in theory, distribute the ransomware without the need for an actor-supplied password for the installation.
Click to expand...

Technical Analysis of MegaCortex Version 2 Ransomware (PDF - 890 KB): https://www.accenture.com/_acnmedia/PDF-106/Accenture-Technical-analysis-MegaCortex.pdf

Minimalist · Aug 5, 2019

Water billing to resume in Baltimore months after hacking

Baltimore is expected to start issuing water bills again this week, months after a ransomware attack that hobbled the city's computer network.
Click to expand...

https://www.fresnobee.com/news/business/technology/article233535422.html

guest · Aug 5, 2019

ECh0raix Ransomware Decryptor Restores QNAP Files For Free
August 5, 2019
https://www.bleepingcomputer.com/ra...mware-decryptor-restores-qnap-files-for-free/

A decryptor for the eCh0raix Ransomware, or QNAPCrypt, has been released that allows victims to recover encrypted files on their QNAP NAS devices.
eCh0raix is a ransomware that has been targeting QNAP NAS devices since June 2018 by brute forcing passwords and exploiting vulnerabilities in order to get access to the device.
Decrypting eCh0raix /QNAPCrypt encrypted files
The good news is that security researcher and ransomware expert BloodDolly has released the eCh0raix Decoder in our support topic for this ransomware. Using this decoder, victims can brute force the decryption key to encrypted files and use it to restore their files.

It should be noted, though, that the current version of the decryptor only support victims who were infected before July 17th. BloodDolly is working on geting it fixed for newer versions. A quick way to tell if its the new unbreakable version is if the key at the end of the ransom note is 173 characters long.
Click to expand...

eCh0raix Decoder: http://download.bleepingcomputer.com/BloodDolly/ECh0raixDecoder.zip

Minimalist · Aug 8, 2019

US Accounts for More than Half of World's Ransomware Attacks

The threat of ransomware is more prevalent in the U.S., with more than half of the global detections originating from this country, a new report informs.

With GandCrab stepping off the scene, other file-encrypting malware filled the gap focusing less on consumers and more on businesses, for an increased chance of getting paid a larger ransom.
Click to expand...

https://www.bleepingcomputer.com/ne...-more-than-half-of-worlds-ransomware-attacks/

ronjor · Aug 9, 2019

mood said: ↑

QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
July 19, 2019
https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/
Click to expand...

iNSYNQ Ransom Attack Began With Phishing Email

A ransomware outbreak that hit QuickBooks cloud hosting firm iNSYNQ in mid-July appears to have started with an email phishing attack that snared an employee working in sales for the company, KrebsOnSecurity has learned. It also looks like the intruders spent roughly ten days rooting around iNSYNQ’s internal network to properly stage things before unleashing the ransomware. iNSYNQ ultimately declined to pay the ransom demand, and it is still working to completely restore customer access to files.
Click to expand...

https://krebsonsecurity.com/2019/08/insynq-ransom-attack-began-with-phishing-email/

guest · Aug 9, 2019

The Week in Ransomware - August 9th 2019 - Summer Doldrums
August 9, 2019
https://www.bleepingcomputer.com/ne...n-ransomware-august-9th-2019-summer-doldrums/

As we creep towards the end of the summer, things have started to thankfully slow down a bit.

While there are still plenty of ransomware attacks going around, the amount we had seen last month against schools, companies, and government agencies has definitely decreased.
The biggest news was a wiper called GermanWiper targeting Germany and pretending to be a ransomware. Otherwise, for this week we mostly saw new variants of existing ransomware being released. [...]
Click to expand...

guest · Aug 10, 2019

mood said: ↑

Emsisoft releases a free decrypter for JSWorm 2.0 Ransomware
May 20, 2019
https://blog.emsisoft.com/en/33239/emsisoft-releases-a-free-decrypter-for-jsworm-2-0-ransomware/
Click to expand...

Emsisoft released a free decryptor for JSWorm 4.0
August 9, 2019
https://securityaffairs.co/wordpress/89666/malware/emsisoft-decryptor-jsworm-4-0.html

Thanks to the experts at Emsisoft the victims of the JSWorm 4.0 ransomware can decrypt their files for free.
Like previous versions of the malware, the JSWorm 4.0 ransomware is also written in C++ and uses a modified version of AES-256 to encrypt files.
The malicious code adds the extension “.[ID-][].JSWRM to the filenames of encrypted files.
Click to expand...

Emsisoft: Emsisoft Decryptor for JSWorm 4.0
Download: https://www.emsisoft.com/ransomware-decryption-tools/download/jsworm-40

guest · Aug 14, 2019

Why School Systems? The Rise of Ransomware in Public Schools
Due to their wealth of data and limited budget for cybersecurity staff and training, schools have drawn the eye of hackers
August 12, 2019
https://www.govtech.com/security/Why-School-Systems-The-Rise-of-Ransomware-in-Public-Schools.html

Ransomware is increasingly being aimed at school districts across the country.

In July alone, the cyberattacks affected systems in New Mexico, Nevada, Louisiana, Oklahoma, Alabama, Connecticut and New York. But these attacks have occurred throughout the year and show no signs of slowing, striking anywhere hackers can find an open door or window.
The recent wave is part of a larger uptick in ransomware attacks on governments across the nation.

“The principal reason is that it’s a relatively easy target to aim for,” he said, explaining that school systems typically suffer from a fairly limited IT staff, older equipment and less-than-optimal cybersecurity expertise.
“This is not random. It’s a business. It’s an enterprise, or multiple enterprises,” he said, emphasizing that typically the teams that target cities or school districts are frequently made up of a combination of professionals.
Click to expand...

Minimalist · Aug 14, 2019

Don’t Pay the Ransom

The F.B.I. should follow the example of European law enforcement and help victims of ransomware decrypt their data.
Click to expand...

https://www.nytimes.com/2019/08/14/opinion/ransomware.html

guest · Aug 15, 2019

Hackers hit CVUSD hit with ransomware attack as school year starts
August 13, 2019
http://www.journalaz.com/news/educa...-ransomware-attack-as-school-year-starts.html

CVUSD is one of numerous schools around the country that have faced these kinds of attacks.

Luckily, the district already had cybersecurity insurance, allowing them to get to work on recovering their systems and trying to fix the problem. Camp Verde Middle School principal and district administrator-in-charge Danny Howe said he was “cautiously optimistic” about the efforts to retrieve the data and get out of this mostly unscathed after more than two weeks.

“For every day that our computers aren’t up in the business office, we’re just getting further and further behind in terms of paying bills,” Howe said. “We’re doing checks and stuff by hand. People still have to get paid”
Click to expand...

guest · Aug 15, 2019

mood said: ↑

Ransomware next target is your favorite radio stations and television channel companies
Click to expand...

KNEO radio station attacked by ransomware
August 12, 2019
https://www.fourstateshomepage.com/news/local-news/kneo-radio-station-attacked-by-ransomware/

The staff of KNEO became aware of the system breakdown Sunday afternoon. The station’s general manager, Mark Taylor, said they had received threats and demands for $100 thousand, but they did not pay and did their best to keep the hackers at bay by having IT technicians work on the issue
The problem was traced back to to Russia, because the type of software used in the attack was similar to what was used to penetrate top government agency computers.

“For what we do here at KNEO Radio, it’s just another challenge that will make us come back stronger than ever,” explained general manager Mark Taylor.
KNEO may sound a little different, but remain on the air while their IT team works to restore their programming and audio files.
Click to expand...

guest · Aug 16, 2019

mood said: ↑

Pharma-testing biz Eurofins Scientific says it fell victim to 'new version' of malware
June 3, 2019
https://www.theregister.co.uk/2019/06/03/eurofins_scientific_malware_breach/
Click to expand...

Cyberattack on forensics firm causes 20,000 police case backlog
August 16, 2019
https://www.theinquirer.net/inquire...ensics-firm-causes-20-000-police-case-backlog

Eurofins Scientific, which carries out DNA, firearm tests, computer forensics and toxicology for UK forces was attacked in June, where a "highly sophisticated" cyberattack led to the suspension of contracts that total around 70,000 cases per year.

"The security and integrity of the criminal justice system is of the highest possible priority, which meant we had to take stringent steps to ensure that police data had, firstly, not been manipulated or changed and, secondly, was suitably protected for the future."
At present, there's no conclusion of the case, with investigations still ongoing. Because of the sensitive nature of the case, details of how that is progressing are likely to be limited.
Click to expand...

guest · Aug 16, 2019

mood said: ↑

Vigo County, Ind., 95 Percent Operational After Cyberattack
August 2, 2019
https://www.govtech.com/security/Vigo-County-Ind-95-Percent-Operational-After-Cyberattack.html
Click to expand...

Vigo County, Ind., Sheriff Says Malware Attack is Contained
August 15, 2019
https://www.govtech.com/data/Vigo-County-Ind-Sheriff-Says-Malware-Attack-Contained.html

The Vigo County, Ind., Sheriff's Office is still working on recovering some data affected by a malware attack, but dispatching and sheriff's operations, including the jail, are running fine.
The online Jailtracker system is still off by a few days for some inmates, Funk said, but corrections are being made.

“We're business as usual now,” Oster said after Wednesday morning's meeting of the 911 Advisory Board.
Click to expand...

guest · Aug 16, 2019

The Week in Ransomware - August 16th 2019 - Fairly Slow
August 16, 2019
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-16th-2019-fairly-slow/

Been a pretty slow week with mostly new variants of existing ransomware being released. The most interesting story was researchers at Check Point being able to install ransomware on a Canon DSLR camera.
Otherwise, not much else going on this week other than new variants. [...]
Click to expand...

guest · Aug 17, 2019

Hosted accountancy software firm iNSYNQ offers ransomware post-mortem
August 16, 2019
https://portswigger.net/daily-swig/...are-firm-insynq-offers-ransomware-post-mortem

Cloud desktop and hosting provider iNSYNQ has offered a post-mortem on a ransomware attack that left accountants and small businesses temporarily unable to access accounting data and other files for several days last month.
In a post-attack statement, published on August 12, around three-weeks after the malware struck, iNSYNQ said that it had been hit with a “previously unseen variant of the virus known as MegaCortex”.

The gang also hit backups even though these are kept on separate servers, pointing towards a deep penetration of iNSYNQ’s systems.
In addition to the incident response blog post, iNSYNQ also published a customer-orientated FAQ, offering answers to questions that came up during a recent webinar.
Click to expand...

iNSYNQ: Company Update Concerning The Megacortex Ransomware Attack

guest · Aug 17, 2019

Ransomware Attack Hits Local Governments In Texas
August 16, 2019
https://www.kut.org/post/ransomware-attack-hits-local-governments-texas

A coordinated ransomware attack has affected at least 20 local government entities in Texas, the Texas Department of Information Resources said. It would not release information about which local governments have been affected.

DIR said the Texas Military Department and the Texas A&M University Systems' Cyber-Response and Security Operations Center teams are deploying resources to "the most critically impacted jurisdictions."
Elliot Sprehe, press secretary for the department, said DIR was working to confirm which government entities are affected and said other information was still coming in.

"It looks like we found out earlier today, but we’re not currently releasing who’s impacted due to security concerns,” he said.
Click to expand...

Minimalist · Aug 19, 2019

Ransomware attacks hit 1 in 5 Americans

Anomali announced the results of a survey conducted by The Harris Poll. It includes responses from more than 2,000 American adults and reveals how Americans believe business and government organizations should respond to ransomware attacks as well as their opinions on cybersecurity in general.
Click to expand...

https://www.helpnetsecurity.com/2019/08/19/ransomware-attacks-americans/

guest · Aug 19, 2019

mood said: ↑

U.S. Virgin Islands hit with ransomware
July 2, 2019
https://www.scmagazine.com/home/sec...ernal-affairs-records-and-citizen-complaints/
Click to expand...

Police Assure the Court Malware Fix is in the Works
August 19, 2019
https://stcroixsource.com/2019/08/19/police-assure-the-court-malware-fix-is-in-the-works/

Since a software infection of computers and laptops at the police department became public in June, little has been said about the extent of the problem. A more complete disclosure was made in a federal court filing made prior to an Aug. 29 hearing before District Court Judge Curtis Gomez.

In July, police compliance officials told the court the ransomware attack encrypted emails, uploaded documents, and different devices used by the police department. But they said the matter is being addressed.
“A new centralized version … is being installed for the territory. Internal Affairs staff is currently working on configuring all users in the system,” according to the VIPD’s quarterly report.
Officials told the court that once the software swap is completed, efforts will be made to prevent future attacks.
Click to expand...

guest · Aug 20, 2019

mood said: ↑

Genesee County ransomware attack more severe than originally thought
April 5, 2019
https://www.scmagazine.com/home/sec...e-attack-more-severe-than-originally-thought/
Click to expand...

After cyber attack, Genesee County could pay $1.8 million to avoid a repeat
August 19, 2019
https://www.mlive.com/news/flint/20...y-could-pay-18-million-to-avoid-a-repeat.html

County officials are ready to spend $1.8 million to fix serious problems with their technology network, a system that was attacked by a ransomware-type virus earlier this year.

The county Board of Commissioners gave preliminary approval Wednesday, Aug. 14, to a series of spending requests to upgrade its computer network, data center, information technology security, phone system, and audio and video equipment.

“Every one of these investments is absolutely necessary ... The county right now is in not much better position than we were when the event happened,” Chief Information Officer Carl Wilson told commissioners Wednesday.
In a memo to the board, Wilson said nearly all technology infrastructure in county government “has reached the end of its useful life and is no longer supported by the manufacturers.”
Click to expand...

guest · Aug 20, 2019

mood said: ↑

Syracuse ransomware attack [...]
Click to expand...

City of Syracuse, police taking steps to bump up cybersecurity
August 20, 2019
https://www.wrvo.org/post/city-syracuse-police-taking-steps-bump-cybersecurity

The city of Syracuse is entering into an agreement with a cybersecurity company to test the city’s network vulnerabilities, free of charge. This comes after the city school district and county libraries suffered cyberattacks last month. The agreement passed the Syracuse Common Council unanimously, but some councilors were skeptical.

The company is called Indev and one of its cofounders is from the Syracuse area. Based in Washington D.C., Indev primarily does work for the federal government and Defense Department contractors.

"It's a scary world out there, and the bad guys are very good at what they do," Prowak said. "Good security can always be defeated."
The cyberattack on the school district, also took down some Syracuse police cameras that were attached to the network. First Deputy Chief Joe Cecile said they missed a couple of major incidents that occurred, which could have been caught on camera.
Click to expand...

Minimalist · Aug 20, 2019

What Americans Think About Ransomware

Nearly half of Americans whose endpoint devices were affected in a ransomware attack say their employers paid the ransom to attackers, a new survey shows.
Click to expand...

https://www.darkreading.com/risk/what-americans-think-about-ransomware/d/d-id/1335571

Minimalist · Aug 20, 2019

Open Source-Based Ransomware Targets Fortnite Players

A new ransomware family specifically targeting users of the Fortnite game is based on the open source Hidden-Cry malware, Cyren’s security researchers have discovered.
Click to expand...

https://www.securityweek.com/open-source-based-ransomware-targets-fortnite-players

guest · Aug 20, 2019

Have you been ransomware’d yet?
You need to understand why this is one of the most potent attacks – what you must do to avoid becoming a target
August 20, 2019
https://www.csoonline.com/article/3432987/have-you-been-ransomwared-yet.html

Some of the most vulnerable and critical agencies are being targeted – state, city and educational institutions. Recent state and local ransomware attacks include the cities of Baltimore and Albany, school districts in Louisiana and 23 cities in Texas. And this is only going to get worse.
With that doomsday prediction out of the way, it’s instructive to get an idea why this is happening.

The targets typically do not have adequate security technical expertise to keep up with software patches, ensure they have the appropriate security tools to keep their systems safe or even have a good ongoing data hygiene practice in place. [...]

So that is where we stand today in terms of why this is happening and how inconsistent the responses are from these unfortunate victims.
But that’s only half the story. There needs to be an urgent and frankly existential need to shore up the defenses NOW.
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Useful Searches