Ransomware and Recent Variants

guest · Sep 10, 2020

SoftServe hit by ransomware, Windows customization tool exploited
September 10, 2020
https://www.bleepingcomputer.com/ne...somware-windows-customization-tool-exploited/

Ukrainian software developer and IT services provider SoftServe suffered a ransomware attack on September 1st that may have led to the theft of customers' source code.

News about a cyberattack on SoftServe first began circulating on the 'Telegram DС8044 Kyiv Info' channel, where an alleged message sent by the company to employees was shared.
In a subsequent statement to Ukrainian technology news site AIN, SoftServe confirmed that a cyberattack had occurred that caused them to disconnect their clients to prevent its spread.

“Yes, there was an attack today. The most significant consequences of the attack are the temporary loss of functionality of a part of the mail system and the halt of some of the auxiliary test environments. As far as we can estimate, this is the greatest impact of the attack, and other systems or client data were not affected.”
It has not been confirmed, but this extension pattern matches those used by the Defray ransomware, also known as RansomEXX, which was recently used against Konica Minolta.
Click to expand...

In a later post to the DС8044 Telegram channel, links were shared to source code repositories that were allegedly stolen during this attack,
Windows customization tool exploited in attack
According to the SoftService incident report, the attackers exploited a DLL hijacking vulnerabilitie in the legitimate Rainmeter application to deploy their ransomware.
Click to expand...

guest · Sep 11, 2020

The Week in Ransomware - September 11th 2020 - A barrage of attacks
September 11, 2020
https://www.bleepingcomputer.com/ne...are-september-11th-2020-a-barrage-of-attacks/

This week has been brutal ransomware attacks have been discovered targeting large organizations worldwide with million-dollar ransoms.
Click to expand...

guest · Sep 14, 2020

Emsisoft Decryptor for Crypt32
September 14, 2020
https://www.emsisoft.com/ransomware-decryption-tools/crypt32

Crypt32 is written with NodeJS, and encrypts victim's files using AES-256 and base64 without appending an extension.
The ransom note "!! YOUR FILES HAS BEEN ENCRYPTED !!.txt" contains the following multi-lingual text: [...]
Click to expand...

Download: https://www.emsisoft.com/ransomware-decryption-tools/download/Crypt32

guest · Sep 16, 2020

Emsisoft Decryptor for Cyborg
September 14, 2020
https://www.emsisoft.com/ransomware-decryption-tools/cyborg

The Cyborg ransomware first appeared in late 2019, and encrypts its victims files using AES-256. Known extensions include ".petra", ".EncryptedFilePayToGetBack", ".Cyborg1", and ".LockIt".
The ransom note "Cyborg_DECRYPT.txt" contains the following text: [...]
Click to expand...

Download: https://www.emsisoft.com/ransomware-decryption-tools/download/Cyborg

guest · Sep 17, 2020

mood said: ↑

Ransomware deploys virtual machines to hide itself from antivirus software
The operators of the RagnarLocker ransomware are running Oracle VirtualBox to hide their presence
May 22, 2020
https://www.zdnet.com/article/ranso...hines-to-hide-itself-from-antivirus-software/

Sophos: Ragnar Locker ransomware deploys virtual machine to dodge security
Click to expand...

Maze ransomware borrows Ragnar Locker tactics to sneak past defences
September 17, 2020
https://www.computerweekly.com/news...-Ragnar-Locker-tactics-to-sneak-past-defences

Taking a tip from their peers, the cyber criminal operators of the Maze ransomware appear to have started to distribute ransomware payloads inside the virtual hard drive of a malicious virtual machine (VM), according to analysts at Sophos’ Managed Threat Response unit.

This technique was pioneered by the group behind Ragnar Locker earlier in 2020 – Ragnar Locker being one of a number of ransomware groups to have come together with Maze to form a cartel-like operation.
Now, with a few tweaks, the technique is being incorporated into Maze’s playbook as well, according to Sophos principal researcher Andrew Brandt and incident response team lead Peter Mackenzie, who have been analysing it.
Click to expand...

In the previous attack, the Ragnar Locker ransomware was deployed in an Oracle VirtualBox Windows XP VM. The Maze gang took a slightly adapted approach, using a Windows 7 machine, not an XP one, which increased the size of the virtual disk quite significantly and added new functionality that was not available to the Ragnar Locker group.

However, the fundamentals of the attack were found to be identical. The Maze payload was again contained in a VirtualBox .vdi file and delivered via a Windows .msi installer file.
Click to expand...

Sophos: Maze attackers adopt Ragnar Locker virtual machine technique

guest · Sep 18, 2020

The Week in Ransomware - September 18th 2020 - Schools under attack
September 18, 2020
https://www.bleepingcomputer.com/ne...are-september-18th-2020-schools-under-attack/

With schools worldwide back in session, ransomware operations are barraging them with cyberattacks that disrupt the start of the school year.

Over the past few weeks, we have seen a steady barrage of attacks against K-12 schools, colleges, and universities where ransomware operators target exposed remote desktop servers and network devices' vulnerabilities.
To warn education institutions of these attacks, the U.K. National Cyber Security Centre (NCSC) has offered guidance on the steps organizations should perform to harden their defenses. [...]
Click to expand...

guest · Sep 18, 2020

Leading U.S. laser developer IPG Photonics hit with ransomware
September 18, 2020
https://www.bleepingcomputer.com/ne...-developer-ipg-photonics-hit-with-ransomware/

IPG Photonics, a leading U.S. developer of fiber lasers for cutting, welding, medical use, and laser weaponry has suffered a ransomware attack that is disrupting their operations.
Based out of Oxford, Massachusets, IPG Photonics has locations worldwide where they employ over 4,000 people and have a $1.3 billion revenue in 2019.
IPG Photonics disrupted by a ransomware attack
On Monday, BleepingComputer was contacted by a source with knowledge of the attack who told us that a ransomware attack had disrupted its operations.

A partial ransom note seen by BleepingComputer also indicates that the RansomExx ransomware operation conducted the attack.
Click to expand...

RansomExx is a rebranded version of the Defray777 ransomware and has seen increased activity since June when they attacked the Texas Department of Transportation (TxDOT) and Konica Minolta in August.
Click to expand...

guest · Sep 19, 2020

Texas DIR Partners with FireEye on Ransomware Defense
September 18, 2020
https://www.govtech.com/security/Texas-DIR-Partners-with-FireEye-on-Ransomware-Defense-.html

With ransomware attacks against government on the rise, the Texas Department of Information Resources (DIR) has teamed up with global cybersecurity vendor FireEye to provide low-cost malware defense to state and local agencies across the Lone Star state.
The new services are being made available via DIR's Bulk Purchase Initiative, which allows it to facilitate procurement of IT hardware and software products on behalf of other state and local agencies.

The recently negotiated arrangement with the firm includes a number of endpoint detection and response solutions, such as its network, email and endpoint security services, as well as threat intelligence and managed defense programs through the company's Mandiant Solutions.

“DIR has made resources available to the Texas public sector market to effectively combat the evolving threat of ransomware, and the need for these resources became even more apparent following last August’s ransomware attack on multiple local governments across Texas,” said DIR Executive Director Amanda Crawford.
Click to expand...

FireEye has seen its ransomware investigations "skyrocket" in recent years, said Pat Sheridan, senior vice president of sales, Americas, at FireEye.
Click to expand...

Minimalist · Sep 21, 2020

Enough is enough: Woman’s death highlights the need for a ban on ransom payments

At the end of 2019, we stated the ransomware threat had reached a crisis level. Since then, the situation has only worsened, with attacks on healthcare and other public and private sector organization continuing and escalating during the course of the pandemic. Even a ventilator manufacturer was attacked.
Click to expand...

https://blog.emsisoft.com/en/36948/...lights-the-need-for-a-ban-on-ransom-payments/

guest · Sep 21, 2020

Gelderland security region hit in ransomware attack
September 14, 2020
https://nltimes.nl/2020/09/14/gelderland-security-region-hit-ransomware-attack

Veiligheidsregio Noord- en Oost-Gelderland (VNOG) was infected by ransomware over the weekend. The attack left the internal systems damaged. Some functionality is limited or not working at all. But the notification systems like P2000 and C2000, with which the security services communicate, are unaffected. "Safety is not at stake," the VNOG said, NOS reports.

The police and the security region are investigating whether the attackers gained access to sensitive data, and what the consequences are. "We are doing everything we can to ensure that all systems can work safely again as soon as possible. How long this will take is currently impossible to say," the VNOG said on Sunday night.
The security region does not know who targeted it.
Click to expand...

guest · Sep 21, 2020

JIA computer system infiltrated in ransomware attack
September 16, 2020
https://www.newsbreak.com/news/2061662093944/jia-computer-system-infiltrated-in-ransomware-attack

Jekyll Island Authority fell victim last week to a ransomware attack that has since been mostly addressed.

JIA Executive Director Jones Hooks informed the authority’s board at its monthly meeting Tuesday that JIA computer systems were infected by a ransomware attack designed to damage or gain unauthorized access to the system.

“All of our computer systems — this was not just within a department — were impacted, and it’s a very serious situation,” Hooks said. “It’s much more than just an interruption of the internet or anything like that.”
Coastal Computers, the third-party provider, isolated and ended the attack before restoring the system. The work is not yet completed, though, and new protective measures are being implemented.
Click to expand...

guest · Sep 22, 2020

Ransomware statistics for 2020: Q2 report
September 22, 2020
https://blog.emsisoft.com/en/36769/ransomware-statistics-for-2020-q2-report/

In Q2 2020, we saw the continued trend of ransomware groups exfiltrating data prior to encryption and using the stolen data as additional leverage to extort victims.

COVID-19 remained an influential force in the Q2 threat landscape and helped cement remote desktop protocol (RDP) as the attack vector of choice for ransomware operators. Many organizations evidently failed to securely implement RDP in their rush to roll out work from home arrangements, leaving RDP connections vulnerable to compromise.
Most commonly reported ransomware strains of Q2 2020
The following chart shows the 10 most commonly reported strains of Q2. A ransomware family known as STOP/Djvu was by far the most common strain, accounting for 71.7% of all submissions. [...]
Click to expand...

Minimalist · Sep 23, 2020

Cyber insurer's security scans reduced ransomware claims by 65%

A cyber insurer's security scans during the underwriting phase and post-issuance have led to a 65% reduction in ransomware claims.

At this years's RSA security conference, FBI Special Agent Joel DeCapua stated that 70-80% of all network breaches are caused by attackers hacking into remote desktop servers exposed on the Internet.
Click to expand...

https://www.bleepingcomputer.com/ne...cans-reduced-ransomware-claims-by-65-percent/

guest · Sep 23, 2020

Group-IB detects a series of ransomware attacks by OldGremlin
September 23, 2020
https://securityaffairs.co/wordpress/108644/malware/oldgremlin-ransomware-attacks.html

Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has detected a successful attack by a ransomware gang, codenamed OldGremlin. The Russian-speaking threat actors are relatively new to the Big Game Hunting.

Since March, the attackers have been trying to conduct multistage attacks on large corporate networks of medical labs, banks, manufacturers, and software developers in Russia. The operators use a suite of custom tools with the ultimate goal of encrypting files in the infected system and holding it for a ransom of about $50,000.
Click to expand...

As the initial vector of their attacks, OldGremlin use spear phishing emails, to which the group adopted creative approach.
In other instances, the gang exploited the COVID-19 theme and anti-government rallies in Belarus in their phishing emails.

The cybercriminals then used the remote access to the victim’s computer, obtained with the help of TinyNode, as a foothold for network reconnaissance, gathering data and lateral movement in the victim’s network.

“What distinguishes OldGremlin from other Russian-speaking threat actors is their fearlessness to work in Russia,” comments Group-IB senior Digital Forensics analyst Oleg Skulkin.
Click to expand...

Group-IB: Big Game Hunting: Now in Russia

Top Russian companies and banks under attack from OldGremlin - a group controlling TinyCryptor ransomware
Click to expand...

guest · Sep 23, 2020

AgeLocker ransomware targets QNAP NAS devices, steals data
September 23, 2020
https://www.bleepingcomputer.com/ne...somware-targets-qnap-nas-devices-steals-data/

QNAP NAS devices are being targeted in attacks by the AgeLocker ransomware, which encrypts the device's data, and in some cases, steal files from the victim.

AgeLocker is ransomware that utilizes an encryption algorithm called Age (Actually Good Encryption) designed to replace GPG for encrypting files, backups, and streams.
In July 2020, we reported about a new ransomware called AgeLocker that was utilizing this algorithm to encrypt victims' files.
AgeLocker now targets QNAP NAS devices
Since the end of August 2020, AgeLocker, or another ransomware utilizing the same encryption, has been targeting publicly exposed QNAP NAS devices and encrypting their files.

Gillespie also confirmed that AgeLocker had picked up in activity towards the end of August as they continued to target QNAP devices worldwide.
Click to expand...

In one submission to ID-R, Michael Gillespie reports that the attackers state they first stole unencrypted files that contain "medical data, scans, backups, etc."
It is unknown how much they are demanding as a ransom or how the attackers are gaining access to the QNAP devices.
Click to expand...

guest · Sep 25, 2020

The Week in Ransomware - September 25th 2020 - A Modern-Day Gold Rush
September 25, 2020
https://www.bleepingcomputer.com/ne...e-september-25th-2020-a-modern-day-gold-rush/

This week showed continued attacks against large organizations as new ransomware operations rush to join a modern-day ransomware gold rush.

Over the past week, ransomware attacks targeted two large organizations and disrupted operations.
The first is eyewear giant Luxottica, who got hit last Sunday, and government technology services provider Tyler Technologies who got hit by RansomExx later in the week.

News also broke this week about how an insurance company utilizes security scans to find exposed and vulnerable devices on clients' networks. These proactive scans have reduced their ransomware claims by 65%! [...]
Click to expand...

guest · Sep 26, 2020

ThunderX ransomware silenced with release of a free decryptor
September 26, 2020
https://www.bleepingcomputer.com/ne...re-silenced-with-release-of-a-free-decryptor/

A decryptor for the ThunderX ransomware has been released by cybersecurity firm Tesorion that lets victims recover their files for free.
ThunderX is a relatively new ransomware that became active towards the end of August 2020.

This decryptor can decrypt files encrypted by the ransomware's current version and have the .tx_locked extension, as shown below.
Once you have the ransom note and encrypted files, download Tesorion's ThunderX Ransomware decryptor and execute it. When prompted, agree with the license agreement, and you will see the following screen.
Click to expand...

guest · Sep 29, 2020

QNAP tells NAS users to update firmware to avoid new type of ransomware
AgeLocker ransomware has been seen infecting QNAP NAS systems since June
September 29, 2020
https://www.zdnet.com/article/qnap-...ate-firmware-to-avoid-new-type-of-ransomware/

Taiwanese hardware vendor QNAP urged customers last week to update the firmware and apps installed on their network-attached storage (NAS) devices to avoid infections with a new strain of ransomware named AgeLocker.

The ransomware has been active since June this year when it first began making victims.
The impossibility of recovering encrypted files without paying the ransom demand is why users should take care to secure QNAP NAS devices.
Click to expand...

Last week, QNAP said it identified two sources of how AgeLocker gains access to QNAP devices. The first is the QNAP device firmware (known as QTS), while the second is one of the default apps that come preinstalled with recent QNAP systems (named PhotoStation).

"QNAP's initial investigation showed that no unpatched vulnerabilities are [currently] found in QTS. All known [AgeLocker-]affected NAS are running older, unpatched QTS versions," the company said in a blog post.
Click to expand...

QNAP: Fight Against AgeLocker With QNAP: Install Software Updates and Follow Best Practices

Since unpatched devices are prone to information security threats, QNAP urges all users to update their device OS and apps to the latest version available. Users should also follow good information security practices such as using strong passwords and installing the Malware Remover app on their NAS.
Click to expand...

guest · Oct 2, 2020

IBM: Ransomware incidents "exploded" in June
September 30, 2020
https://www.itpro.co.uk/security/ransomware/357290/ransomware-incidents-exploded-in-june-says-ibm

IBM says ransomware incidents "exploded" in June 2020, which saw twice as many ransomware attacks as the month prior.

The month of June accounted for one-third of all the ransomware attacks dealt with by IBM Security X-Force Incident Response this year so far, according to new findings published this week.
According to the report, one in four cyber security incidents in 2020 so far had been caused by ransomware, and IBM warns that ransom demands are also rapidly increasing, with some demands surpassing $40 million (£31 million).
Click to expand...

guest · Oct 2, 2020

Northern California casino shut down by external computer attack, may be ransomware
September 30, 2020
https://www.sacbee.com/news/local/article246132265.html

Northern California’s Cache Creek Casino Resort, which has been shut down since Sept. 20 because of what it called a “systems infrastructure failure,” confirmed Wednesday that its computer systems were the target of an outside attack and that the incident is under investigation.

“While our investigation is ongoing, we have confirmed the cause was an external attack on our computer network,” the Yocha Dehe Wintun Nation, owners of the casino, said in response to questions from The Sacramento Bee.
Sources, not at liberty to speak on the matter, told The Bee that the FBI is looking into whether the incident is a ransomware attack aimed at holding Cache Creek’s network and information hostage in return for payment, but a casino spokesman declined to comment further than the statement.
Click to expand...

In February and March, two Las Vegas casinos reportedly shut down slot machine operations because of a suspected ransomware attack. “Four Queens Hotel and Casino and Binion’s Casino in downtown Las Vegas [...]” Computer Business Review Online reported at the time.
Click to expand...

guest · Oct 2, 2020

The Week in Ransomware - October 2nd 2020 - Healthcare under attack
October 2, 2020
https://www.bleepingcomputer.com/ne...are-october-2nd-2020-healthcare-under-attack/

This week started with a bang as a large hospital chain was hit by a ransomware attack that disrupted the healthcare industry.

We first learned of this Ryuk Ransomware attack on Universal Health Services (UHS) on Monday morning when doctors, nurses, and employees reported on Reddit that their hospitals were affected.
We also learned about a ransomware attack on insurance giant Arthur J. Gallagher (AJG), but it is not known which ransomware conducted the attack. [...]
Click to expand...

Minimalist · Oct 6, 2020

How Did ‘Ransomware’ Get So Bad?

A woman died from treatment delays after a hospital in Germany hit by a cyberattack was forced to turn away emergency patients. Hackers released private information, including Social Security numbers, from a Las Vegas school district. A coronavirus vaccine trial was bogged down in recent weeks when researchers were locked out of their data.

This is a small sample of the toll from ransomware attacks, in which hackers break into computer networks and freeze the digital information until the targeted organization or city pays for its release. Victims have two bad choices: Give in to extortion and hope the criminals didn’t do too much damage, or refuse and risk the hackers releasing or deleting essential information. It might also cost more than the ransom to rebuild computer systems.

I spoke to Charles Carmakal, an executive with the cybersecurity response company FireEye Mandiant, about the root causes and fixes for ransomware attacks.
Click to expand...

https://www.nytimes.com/2020/10/05/technology/how-did-ransomware-get-so-bad.html

guest · Oct 7, 2020

Ransomware threat surge, Ryuk attacks about 20 orgs per week
October 6, 2020
https://www.bleepingcomputer.com/ne...at-surge-ryuk-attacks-about-20-orgs-per-week/

Malware researchers monitoring ransomware threats noticed a sharp increase in these attacks over the past months compared to the first six months of 2020.

At the top of the list are Maze, Ryuk, and REvil (Sodinokibi) ransomware families, according to recently published data from Check Point and IBM Security X-Force Incident Response team.
Both companies observed a surge in ransomware incidents at a global level between June and September, with some threats being more active than others.
Click to expand...

The company says that ransomware attacks increased by 50% at a global level in the third quarter of 2020 and that Ryuk and Maze were the most prevalent threats.
In late September, the company reported that Maze accounted for 12% of all the ransomware attacks its X-Force Incident Response team investigated this year.

Continuous data backups stored offline are still a good practice that can ensure faster recovery from such an attack, as is applying security updates in a timely fashion and restricting or disabling remote access to the company's internal network.
Click to expand...

Check Point: Global Surges in Ransomware Attacks

In Q3 2020, Check Point Research saw a 50% increase in the daily average of ransomware attacks, compared to the first half of the year

Countries with the most number of ransomware attacks in Q3 are US, India, Sri Lanka, Russia and Turkey

Top ransomware types in Q3 were Maze and Ryuk

Ryuk ransomware now attacks 20 organizations a week

Click to expand...

guest · Oct 8, 2020

Hall County, Georgia reports ransomware attack
Hall County experiences network outage
October 8, 2020
https://www.hallcounty.org/CivicAlerts.aspx?AID=829

A ransomware attack has occurred involving critical systems within the Hall County Government networks, including an interruption of phone services. As soon as it occurred, the County began working to investigate the cause, to restore operations, and determine the effects of the incident. Hall County has also enlisted the assistance of third party cyber security professionals to expedite the recovery.
Emergency services were not and will not be disrupted.

At this time, there is no evidence to show that citizen or employee data has been compromised. However, citizens and employees are encouraged to take precautionary measures to monitor and protect their personal information.
Click to expand...

(UPDATE: OCT. 8, 8:30 AM)
Hall County Government phone service has been partially restored.
(UPDATE: OCT. 8, 12:00 P.M.)
Department phone services are now available.
Click to expand...

Minimalist · Oct 9, 2020

The Week in Ransomware - October 9th 2020 - Giant ransoms

Ransomware continues to run rampant this week, with well-known organizations getting hit with massive ransomware attacks.
Click to expand...

https://www.bleepingcomputer.com/ne...in-ransomware-october-9th-2020-giant-ransoms/

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Useful Searches