Ransomware and Recent Variants

Minimalist · Jul 3, 2020

Avaddon ransomware shows that Excel 4.0 macros are still effective

Avaddon ransomware has been spreading this week via an old technique that's making a comeback, Microsoft cautions on Thursday.

The attacks appear to be more targeted and rely on malicious Excel 4.0 macros to download the malware directly on the system.
Click to expand...

https://www.bleepingcomputer.com/ne...ows-that-excel-40-macros-are-still-effective/

Minimalist · Jul 3, 2020

The Week in Ransomware - July 3rd 2020 - Yes, Macs need antivirus

Many macOS users, including my family and friends, have been under the impression that Macs are not affected by malware and thus do not need security software. After this week, I hope the point is clear; that assumption is wrong, and Macs need antivirus software.
Click to expand...

https://www.bleepingcomputer.com/ne...omware-july-3rd-2020-yes-macs-need-antivirus/

Minimalist · Jul 3, 2020

Try2Cry ransomware tries to worm its way to other Windows systems

A new ransomware known as Try2Cry is trying to worm its way onto other Windows computers by infecting USB flash drives and using Windows shortcuts (LNK files) posing as the targets' files to lure them into infecting themselves.
Click to expand...

https://www.bleepingcomputer.com/ne...ies-to-worm-its-way-to-other-windows-systems/

Minimalist · Jul 4, 2020

The Most Malicious Ransomwares Demanding Crypto to Watch Out For

As tech advances, so too, do the malware attacks. Amid a pandemic, ransomwares are turning to privacy-centric coins to get away with crime.
Click to expand...

https://cointelegraph.com/news/the-five-most-malicious-ransomwares-demanding-crypto-to-watch-out-for

guest · Jul 4, 2020

Data breach at CNY Works career center may have exposed personal information of 56,000 clients
July 2, 2020
https://www.syracuse.com/business/2...ed-personal-information-of-56000-clients.html

A data breach at CNY Works may have exposed the names and Social Security numbers of 56,000 people who have used the nonprofit agency’s services to find jobs.

Clients potentially impacted by the breach began receiving letters from the agency this week warning that files targeted by a suspected ransomware attack on the agency’s servers contained their names and Social Security numbers.

“We are sending notification letters to approximately 56,000 individuals,” Lenore Sealy, the agency’s executive director, said in an email to syracuse.com and The Post-Standard. “However, we are notifying individuals out of an abundance of caution. CNY Works has no evidence that any of the personal information for these individuals has been misused, [...]”
Click to expand...

The agency said it became aware of a “potential ransomware incident” on Dec. 21, 2019, “when we learned that malware had infected our systems and encrypted files on several servers.”
Sealy said the agency did not send out the warning letters until now because its investigation did not discover until May 27 that some personal data were present in the encrypted files.
Click to expand...

guest · Jul 6, 2020

DXC Technology Says Its Subsidiary Xchanging Experienced Ransomware Attack
July 5, 2020
https://www.nasdaq.com/articles/dxc...ging-experienced-ransomware-attack-2020-07-05

DXC Technology (DXC) said that certain systems of its subsidiary, Xchanging, have experienced a ransomware attack. Xchanging is primarily an insurance managed services business that operates on a standalone basis.

The company said it is confident that this incident is isolated to the Xchanging environment.
In addition, DXC does not have any indication at this time that data has been compromised or lost.

The company noted that it has implemented a series of containment and remediation measures to resolve this situation. It is actively working with affected customers to restore access to their operating environment as quickly as possible.
Click to expand...

Minimalist · Jul 6, 2020

Thanos Ransomware Adds New Features

A ransomware tool launched late last year has emerged as one of the most complex and adaptable malware-as-a-service variants on the scene, researchers have warned.

The Thanos ransomware, named after a Marvel supervillain, launched in November 2019 and has continued to evolve rapidly, with the addition of specialised tools and features.
Click to expand...

https://www.silicon.co.uk/workspace/thanos-ransomware-346190

guest · Jul 9, 2020

Powerful Conti Ransomware Emerges
July 9, 2020
https://www.securityweek.com/powerful-conti-ransomware-emerges

Dubbed Conti, the malware improves performance through the use of “up to 32 simultaneous encryption efforts,” and is likely directly controlled by its operators, which means that it can target network-based resources and skip local files, similarly with what the Sodinokibi ransomware can do.

Furthermore, the new ransomware abuses the Windows Restart Manager to close applications that lock certain files, thus making sure it can encrypt all the data it wants.
Conti also includes various anti-analysis capabilities, such as a unique string encoding routine of 277 different algorithms per string.
Click to expand...

While there are other ransomware families out there that target data on network shares, Conti is unique due to support for command line arguments that would direct the encryption to either the local hard drive or network shares, or even to specific IP addresses.

“The notable effect of this capability is that it can cause targeted damage in an environment in a method that could frustrate incident response activities. A successful attack may have destruction that’s limited to the shares of a server that has no Internet capability, but where there is no evidence of similar destruction elsewhere in the environment,” Carbon Black explains.
Conti also blocks recovery on the local system, leveraging vssadmin to ensure the deletion of Windows Volume Shadow Copies and executing no less than 146 commands for stopping services that might interfere with its routine.
Click to expand...

Carbon Black: TAU Threat Discovery: Conti Ransomware

Conti is a new family of ransomware observed in the wild by the Carbon Black Threat Analysis Unit (TAU). Unlike most ransomware, Conti contains unique features that separate it in terms of performance and focus on network-based targets.
Click to expand...

Minimalist · Jul 9, 2020

State of Ransomware in the US: Report and Statistics for Q1 and Q2 2020

In 2019, an unprecedented number of US governments, healthcare providers and educational establishments were impacted by ransomware, with at least 966 entities being successfully attacked at the cost of $7.5 billion.

Between January and April 2020, the number of successful attacks on public sector entities decreased month-over-month as the COVID-19 crisis worsened. We are, however, seeing a reversal in that trend with the number of incidents now starting to increase. This may be due to the lifting of restrictions and employees returning to the workplace or simply a normal season spike.
Click to expand...

https://blog.emsisoft.com/en/36534/...-us-report-and-statistics-for-q1-and-q2-2020/

guest · Jul 10, 2020

The Week in Ransomware - July 10th 2020 - A quiet week
July 10, 2020
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-july-10th-2020-a-quiet-week/

It has been a pretty quiet week with few alleged attacks against corporate victims and mostly new variants of existing ransomware released.

The most interesting news is the Conti ransomware that appears to share the same code as Ryuk and could possibly be its successor. Ryuk has significantly decreased in activity over the past couple of months, while Conti has seen an increase.
Only time will tell, but Conti is definitely one that we need to keep an eye on. [...]
Click to expand...

Minimalist · Jul 13, 2020

The chance of data being stolen in a ransomware attack is greater than one in ten.

The data theft and name-and-shame tactics initiated by Maze in November 2019 and subsequently adopted by multiple other groups have blurred the line between ransomware attack and data breach.
Click to expand...

https://blog.emsisoft.com/en/36569/...ransomware-attack-is-greater-than-one-in-ten/

Minimalist · Jul 14, 2020

New AgeLocker Ransomware uses Googler's utility to encrypt files

A new and targeted ransomware named AgeLocker utilizes the 'Age' encryption tool created by a Google employee to encrypt victim's files.
Click to expand...

https://www.bleepingcomputer.com/ne...mware-uses-googlers-utility-to-encrypt-files/

ronjor · Jul 16, 2020

Ransomware accounts for a third of all cyberattacks against organizations

by Lance Whitney July 15, 2020
Government agencies were most heavily hit by ransomware during the first quarter, says Positive Technologies.
Click to expand...

guest · Jul 17, 2020

The Week in Ransomware - July 17th 2020 - Freshly squeezed
July 17, 2020
https://www.bleepingcomputer.com/ne...n-ransomware-july-17th-2020-freshly-squeezed/

The biggest news is Orange confirming they were hit with a Nefilim ransomware attack and business customer's data being stolen. We also saw an interesting ransomware that utilizes the Age encryption tool.
Other than that, it has mostly been smaller attackers and new ransomware variants released. [...]
Click to expand...

hawki · Jul 23, 2020

"Ransomware attack locked a football club's turnstiles

A ransomware attack against an English football club crippled corporate and security systems, stopping the turnstiles from working, something that stopped fans being able to get in or out of the stadium and almost led to the cancellation of the league fixture, which would have cost the club hundreds of thousands of pounds in lost income.

It's believed that attackers got into the network via a phishing email or by remote access to the connected CCTV system..."

https://www.zdnet.com/article/ranso...turnstiles-almost-leading-to-cancelled-match/

guest · Jul 23, 2020

Garmin dealing with massive service outage after ransomware attack
The outage is expected to last through the end of the week
July 23, 2020
https://www.androidcentral.com/garmin-connect-suffers-multi-hour-outage

Update, June 23 (2:50 pm ET) — The outage and downtime have been attributed to a ransomware attack
ZDNet reports that the outage is due to a ransomware attack. According to ITHome, Garmin expects services to remain down possibly through July 25th while it works to resolve the issue and secure user data.
Click to expand...

If you're having trouble syncing your phone with your Garmin smartwatch, it's not your fault. Garmin Connect has been suffering an outage that has stretched on for several hours, starting at around 11:30 p.m. ET on July 22 according to comments on Twitter.

As the hours stretched on, it eventually admitted it was suffering an outage that affected almost every consumer-facing area, including its app, site, and even customer support centers.

We are currently experiencing an outage that affects Garmin Connect, and as a result, the Garmin Connect website and mobile app are down at this time.
— Garmin Fitness (@GarminFitness) July 23, 2020
Click to expand...

stapp · Jul 24, 2020

Garmin outage confirmed as being by WastedLocker ransomware attack.

Evil Corp (aka the Dridex gang) is a Russian-based cybercriminal group active since at least 2007 known to be the ones behind Dridex malware and for using ransomware as part of their attacks including Locky ransomware and their own ransomware strain known as BitPaymer.
Evil Corp gang was sanctioned by the U.S. Treasury Department in December 2019 after being charged for using Dridex to cause more than $100 million in financial damages.
Due to this, it is a tricky situation for Garmin if they want to pay the ransom as they would potentially be violating United States sanctions.
Click to expand...

https://www.bleepingcomputer.com/ne...-by-confirmed-wastedlocker-ransomware-attack/

guest · Jul 24, 2020

The Week in Ransomware - July 24th 2020 - Navigation failure
July 24, 2020
https://www.bleepingcomputer.com/ne...ransomware-july-24th-2020-navigation-failure/

This week has been quite busy with a new enterprise targeting ransomware called Exorcist and attacks against large companies.

The biggest news this week is the attack on Garmin who suffered a worldwide outage since July 23rd. Today, BleepingComputer has been able to confirm that Garmin suffered a WastedLocker Ransomware attack.
There was also interesting analysis released this week on the Lazarus APT group, Maze, and WastedLocker from various security firms. [...]
Click to expand...

guest · Jul 24, 2020

mood said: ↑

Keizer city computers hacked
June 17, 2020
https://www.keizertimes.com/posts/1639/keizer-city-computers-hacked
Click to expand...

Hacker sets city back $60K
July 24, 2020
https://www.keizertimes.com/posts/1770/hacker-sets-city-back-60k

The costs of recovering city data and preventing future digital strikes have already exceeded the ransom demanded by the hackers who locked it up in the first place.
Keizer Finance Director Tim Wood said the city would be supplying the public with additional information regarding the hack at a future date once the forensic investigation wraps up.
[...]
Click to expand...

Arete provided negotiation services, is conducting a forensic analysis [...] The cost for those services was $36,230.

The payment of the ransom and a 2 percent transaction fee was covered by the city’s cyberinsurance provider. [...] a new virus protection program, SentinelOne to protect against future attacks. The cost is $12,418 for a 36-month subscription and the program covers 160 computers.

In addition to those costs, the city will pay between $10,000 and $15,000 to Lewis Brisbois Bisgaard & Lewis, a Portland-based law firm [...]
Click to expand...

hawki · Jul 26, 2020

mood said: ↑

Garmin dealing with massive service outage after ransomware attack
The outage is expected to last through the end of the week
July 23, 2020
https://www.androidcentral.com/garmin-connect-suffers-multi-hour-outage
Click to expand...

"Garmin is reportedly being asked to pay a $10 million ransom to free its systems from a cyberattack that has taken down many of its services..."

https://www.forbes.com/sites/barryc...0m-ransom-to-end-two-day-outage/#5cd2bacd3164

guest · Jul 26, 2020

Inside "Phobos" Ransomware: "Dharma" Past & Underground
July 24, 2020
https://www.advanced-intel.com/post/inside-phobos-ransomware-dharma-past-underground

What is Phobos Ransomware?
Phobos is a type of Advanced Encryption Standard (AES) ransomware that was first seen in October 2017 but became increasingly active in 2019. Also referred to as Phobos NextGen or Phobos Not Dharma, Phobos ransomware is extremely similar to the Dharma and Crysis ransomware family due to the same Dharma codebase.
[...]
Conclusion
As one can see from the forum threads, Phobos is continuously evolving to be more effective while simultaneously recruiting new users. From previous accounts of negotiations, many Phobos operators are unskilled or unprofessional, but that does not make the use of this ransomware any less dangerous. As Phobos continues to evolve, there may be more updates to come on the ransomware in the coming months and throughout the year.
Click to expand...

guest · Jul 27, 2020

Garmin services begin to come back online after 'Russian hacker demanded $10m to restore systems
July 27, 2020
https://www.dailymail.co.uk/news/ar...sian-hacker-demanded-10m-restore-systems.html

Garmin services began to slowly return Monday morning after the company was hacked and allegedly held to ransom by Russian group Evil Corps, who demanded $10 million to restore their operation.

Tens of millions of people around the world found the firm's GPS and fitness-trackers, including those used by runners, cyclists and pilots, down for a fifth day Sunday.
Garmin is yet to comment on the service return or the hacking claims amid reports they were ordered to pay the ransom by the cybercriminal group headed by a 33-year-old Russian playboy hacker, Maksim Yakubets [...]
Click to expand...

guest · Jul 27, 2020

ProLock ransomware – new report reveals the evolution of a threat
July 27, 2020
https://nakedsecurity.sophos.com/20...new-report-reveals-the-evolution-of-a-threat/

SophosLabs has just published a new report on a ransomware strain known as ProLock, which is interesting not so much for its implementation as for its evolution.
Encryption with a difference
Interestingly, ProLock doesn’t actually scramble every byte of every file it attacks.
In the ProLock sample analysed by SophosLabs, the first 8KB (8192 bytes, or 0x2000 in hex) of every file are left untouched.
As a result, files of 8KB or below are unmodified, while files bigger than 8192 bytes are encrypted but with the first 8KB intact.

ProLock also has some other interesting tricks to learn about, including obscuring the ransomware executable itself by hiding it inside a BMP (bitmap image) file that displays as an almost-uniform and apparently uninteresting black rectangle if you open it for inspection.
Click to expand...

Sophos: ProLock ransomware gives you the first 8 kilobytes of decryption for free

The ransomware, called ProLock, is a successor to PwndLocker, a ransomware strain that emerged late in 2019.
As with other targeted ransomware attacks, ProLock’s encryption of files should be considered just the final act in the attack. [...]
Click to expand...

guest · Jul 30, 2020

mood said: ↑

DXC Technology Says Its Subsidiary Xchanging Experienced Ransomware Attack
July 5, 2020
https://www.nasdaq.com/articles/dxc...ging-experienced-ransomware-attack-2020-07-05
Click to expand...

DXC says ransomware attack disrupted customer operations at insurance services arm but barely left a scratch
July 30, 2020
https://www.theregister.com/2020/07/30/dxc_ransomware_attack/

DXC has recovered from a ransomware attack that hit its independent services-for-insurers operation Xchanging.

DXC didn’t detail which ransomware it received, but it was clearly disruptive for Xchanging clients because the services giant revealed it was “working with affected customers to restore access to their operating environment as quickly as possible.” DXC clients were insulated from the incident because Xchanging is a standalone operation.
Click to expand...

Now DXC has offered additional detail and “confirmed containment of the incident in the immediate days following identification with minimal impact on Xchanging customers; no loss of DXC or Xchanging customer data; no impact on the wider Xchanging or DXC IT estates; and full restoration of Xchanging customer operations.”
Bullet dodged, then. Or was it?

DXC has not offered any information on the extent of the disruptions to clients, but did say: “DXC teams worked with affected Xchanging customers to restore access to their operating environments as quickly as possible and shared Indicators of Compromise (IOCs) and other relevant technical information.”
Click to expand...

guest · Jul 30, 2020

Athens ISD pays $50K for release of data in ransomware attack
July 29, 2020
https://www.easttexasmatters.com/ne...50k-for-release-of-data-in-ransomware-attack/

Athens ISD Board of Trustees has agreed to pay a $50,000 ransom for school data that was taken in a criminal ransomware attack.

The attack targeted data stored on district servers, backup systems, and hundreds of computers. As a result, access to data has been blocked including teacher communications, student schedules, grades, and assignments.
Further investigation revealed that no information has been taken, only encrypted to prevent access until a ransom was paid.

“The first thing we want to do is ensure our staff and student families that, to the best of our knowledge, no personal data has been compromised,” said Superintendent Dr. Janie Sims. “Whoever is behind this attack has not taken the information; they have encrypted it so that we have no access unless we meet their ransom demand.”
Click to expand...

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

hawki Registered Member

guest Guest

stapp Global Moderator

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

guest Guest

hawki Registered Member

guest Guest

stapp Global Moderator

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches