Ransomware and Recent Variants

hi
I guess we we need a good hips

 

Yet another good reason to set UAC to highest level:

-https://blog.malwarebytes.com/threat-analysis/2016/03/cerber-ransomware-new-but-mature/

 

HDDCryptor Ransomware Locks Hard-Drive Boot Records

http://news.softpedia.com/news/hddcryptor-ransomware-locks-hard-drive-boot-records-508427.shtml

 

Crysis Ransomware Employing RDP Brute-Force Attacks in New Campaign

http://news.softpedia.com/news/crys...te-force-attacks-in-new-campaign-508444.shtml

 

MarsJoke Ransomware Targets the Government and K-12 Educational Sector

http://news.softpedia.com/news/mars...ment-and-k-12-educational-sector-508608.shtml

 

New Open Source Linux Ransomware Divides Infosec Community

http://news.softpedia.com/news/new-...e-shows-infosec-community-divide-508669.shtml

 

Unlock92 Ransomware Is the Quiet Threat That Nobody Heard About

http://news.softpedia.com/news/unlo...t-threat-that-nobody-heard-about-508742.shtml

 

Bitter Ransomware Operator Shuts Down Service and Deletes Decryption Master Key

http://news.softpedia.com/news/bitt...nd-deletes-decryption-master-key-508796.shtml

 

It would be nice to know if criminal charges were brought against this character.

 

Locky Drops Offline Mode and Switches to New ODIN Extension

http://news.softpedia.com/news/lock...d-switches-to-new-odin-extension-508840.shtml

 

Researchers break Marsjoke ransomware encryption

https://threatpost.com/researchers-break-marsjoke-ransomware-encryption

 

How Stampado Ransomware Analysis Led To Yara Improvements

http://blog.trendmicro.com/trendlab...do-ransomware-analysis-led-yara-improvements/

 

New Cerber ransomware variant kills common database-related processes

http://securityaffairs.co/wordpress/51956/malware/new-cerber-ransomware.html

 

The fall of the Encryptor RaaS also thanks to Shodan

http://securityaffairs.co/wordpress/52061/malware/encryptor-raas-fall.html

 

Anyone who has disabled wscript.exe or is monitoring its execution is covered from this puppy.

 

In addition to js and wsf coded ransomware there has been an increasing number of hta Locky malware. These are totally independent of wscript but instead will use mshta and rundll32 to execute.