Ransomware and Recent Variants

Minimalist · Nov 1, 2021

Ransomware Hackers Freeze Millions in Papua New Guinea

Papua New Guinea’s finance department acknowledged late Thursday that its payment system, which manages access to hundreds of millions of dollars in foreign aid money, was hit with a ransomware attack.

The attack on the Department of Finance’s Integrated Financial Management System (IFMS) occurred at 1 a.m. local time on Oct. 22, according to a statement released by John Pundari, finance minister and acting treasurer.
Click to expand...

https://www.bloomberg.com/news/arti...finance-department-hit-with-ransomware-attack

guest · Nov 3, 2021

Sinclair Broadcast Group says ransomware incident not 'fully resolved' weeks after breach
November 3, 2021
https://www.cyberscoop.com/sinclair-broadcast-group-ransomware-ongoing-disruption-macaw/

The ransomware attack on conservative broadcasting giant Sinclair is still causing problems, the company reported in a U.S. Securities and Exchange Commission filing Wednesday.

Noting that the investigation is ongoing, the notice reports that the Oct. 17 intrusion “has not yet been fully resolved, and certain disruptions to … business and operations remain.” The full extent of the impact on Sinclair’s “business, operations and financial results is not known at the present time.”
Click to expand...

“Our employees’ quick response and creative workarounds have helped us restore a significant portion of our systems,” Chris Ripley, the company’s president and CEO, said in the filing. “As we work to complete our investigation, we will look for opportunities to enhance our existing security measures.”
Click to expand...

Researchers blamed the group, saying it had used a new strain of malware called Macaw to target Sinclair, perhaps as a means to facilitate payments from U.S. targets that would otherwise be barred from paying ransoms.
Click to expand...

guest · Nov 5, 2021

The Week in Ransomware - November 5th 2021 - Placing bounties
November 5, 2021
https://www.bleepingcomputer.com/ne...ansomware-november-5th-2021-placing-bounties/

Law enforcement continues to keep up the pressure on ransomware operations with infrastructure hacks and million-dollar rewards, leading to the shut down of criminal operations.

Due to this increased pressure by law enforcement, the BlackMatter (DarkSide) ransomware gang announced to affiliates that they were shutting down this week after members were missing.
BleepingComputer later discovered that BlackMatter began moving existing victims to LockBit ransomware's infrastructure to continue extortion demands.
Click to expand...

The FBI also issued advisories this week warning that HelloKitty has added DDoS attacks to their arsenal, that ransomware gangs commonly conduct attacks "during time-sensitive financial events," and that gangs are targeting tribal-owned businesses, including casinos. [...]
Click to expand...

guest · Nov 10, 2021

mood said: ↑

TTC says investigation underway amid ransomware attack
October 29, 2021
https://globalnews.ca/news/8337090/ttc-ransomware-attack/
Click to expand...

Toronto’s transit agency cyberattack exposes 25,000 employees’ data
November 10, 2021
https://techcrunch.com/2021/11/10/toronto-cyberattack-employee-data/

The Toronto Transit Commission has confirmed that the personal information of tens of thousands of employees may have been compromised as a result of a ransomware attack on its systems last month.

The TTC, which operates Toronto’s bus, subway, streetcar and paratransit systems, said in a statement that the compromised data includes the names, addresses and Social Insurance Numbers of 25,000 past and present employees. The agency said it’s continuing to investigate whether a “small number” of customers and vendors have also been affected.
Click to expand...

The ransomware attack on October 29 resulted in problems with vehicle tracking and “next bus” systems, and the loss of the online Wheel-Trans booking system, said TTC chief executive Rick Leary. He added that the incident resulted in “a number of the TTC’s servers being encrypted and locked,” While most customer-facing systems have been restored already, the TTC’s internal email system remains offline.

“Over the coming weeks, we will continue rebuilding the remaining impacted servers and internal services, like re-establishing external e-mail capabilities. But in truth, and based on the experiences of other organizations, this could take some time.”
Click to expand...

guest · Nov 12, 2021

The Week in Ransomware - November 12th 2021 - Targeting REvil
November 12, 2021
https://www.bleepingcomputer.com/ne...ansomware-november-12th-2021-targeting-revil/

This week, law enforcement struck a massive blow against the REvil ransomware operation, with multiple arrests announced and the seizure of cryptocurrency.

On Monday, the US Department of Justice, Europol, and Interpol announced arrests of REvil affiliates and members in Kuwait and Romania. The FBI also announced the arrest of the REvil affiliate behind the July Kaseya attack that encrypted over 1,500 organizations.
In addition, the US announced that $6 million in ransom payments was seized from the REvil ransomware operation.

This week, the other big news is a massive attack on the European electronics retailer MediaMarkt by the Hive Ransomware operation. [...]
Click to expand...

guest · Nov 13, 2021

Kisters AG victim of ransomware attack (Nov. 10/11, 2021)
November 13, 2021
https://borncity.com/win/2021/11/13/kisters-ag-opfer-eines-ransomware-angriffs-10-11-nov-2021/

The medium-sized an German based company Kisters AG, which develops software solutions for sustainable resource management and now has numerous branches worldwide, has fallen victim to a ransomware attack. Following the attack on November 10/11, 2021, all systems are now down and the website is not accessible. Here is a brief overview of what is known. Furthermore, the Bucher community vehicle division (Switzerland) are victims of a ransomware attack.
Ransomware attack on Kisters AG
I just came across this new case of a ransomware attack on the medium-sized company Kisters AG through the following tweet.
Click to expand...

Currently, the company's German website is offline and returns error 403, so I had to pull the following company cyber incident notice from their Engllish site.

At the moment, KISTERS AG cannot make any statements about which data is affected by the attack. "Transparency is the most important thing for us in this situation. We will inform our customers clearly and openly when we know what data is affected and when we can return to normal business operations," says Managing Director Klaus Kisters.
Currently, all experts are working in crisis mode. [...]
Sounds dramatically, but details about the infection vector or affected data are not available.
Click to expand...

guest · Nov 19, 2021

The Week in Ransomware - November 19th 2021 - Targeting Conti
November 19, 2021
https://www.bleepingcomputer.com/ne...ansomware-november-19th-2021-targeting-conti/

While last week was full of arrests and law enforcement actions, this week has been much quieter, with mostly new research released.
Click to expand...

guest · Dec 6, 2021

Ransomware statistics for 2021: Q3 report
December 2, 2021

In Q3 2021, ransomware group REvil issued the largest publicly known ransom demand to date – $70 million – following a monumental attack on MSP software provider Kaseya in early July.
The incident drew significant attention from the media and the authorities. In an attempt, perhaps, to escape the spotlight, REvil ceased all operations less than two weeks after the attack, shutting down its dark web leak site and payment portal.

Q3 also marked the arrival of BlackMatter, a new ransomware group that we believe to be a repaint of DarkSide.
Most commonly reported ransomware strains of Q3 2021
The following chart shows the 10 most commonly reported strains of Q3, which collectively made up 91.30% of all submissions this quarter. A ransomware family known as STOP/Djvu was by far the most common strain, accounting for 76.40% of all submissions. [...]
Click to expand...

guest · Dec 6, 2021

The Week in Ransomware - December 3rd 2021 - Seizing Bitcoin
December 3, 2021

For this week's 'Week in Ransomware' article we have included the latest ransomware news over the past two weeks.

The biggest news over the past two weeks is the unsealing of a United States' Complaint for Forfeiture detailing how the FBI seized 39.89138522 bitcoins from an Exodus wallet belonging to an REvil affiliate. Based on the email listed in the court document, it is believed that the affiliate is one known as 'Lalartu.'
We also learned that the BlackByte ransomware gang exploits the Microsoft Exchange ProxyShell vulnerabilities to gain initial access to internal networks. Therefore, make sure to update your servers. [...]
Click to expand...

Minimalist · Dec 10, 2021

BlackCat: A New Rust-based Ransomware Malware Spotted in the Wild

Details have emerged about what's the first Rust-language-based ransomware strain spotted in the wild that has already amassed "some victims from different countries" since its launch last month.
Click to expand...

https://thehackernews.com/2021/12/blackcat-new-rust-based-ransomware.html

Minimalist · Dec 11, 2021

The Week in Ransomware - December 10th 2021 - Project CODA

This week has quite a bit of ransomware news, including arrests, a new and sophisticated ransomware, and an attack bringing down 300 supermarkets in England.
Click to expand...

https://www.bleepingcomputer.com/ne...n-ransomware-december-10th-2021-project-coda/

Minimalist · Dec 13, 2021

Forget the dark web: ransomware gangs weaponize social media to pressure victims

The threat of public exposure is a core part of the ransomware playbook. The more eyeballs on an incident, the greater the embarrassment, reputational damage and risk of litigation for the victim – and the higher the chance of a payout for the ransomware gang responsible for the attack.

But not every attack captures the attention of the public. With the news cycle already saturated with cyber attacks, it’s all too easy for run of the mill incidents to get lost in the wash.

Now, in an effort to amplify coverage, some ransomware groups are using social media channels to bring news of their conquests to a wider audience and put more pressure on victims to pay the ransom.
Click to expand...

https://blog.emsisoft.com/en/39389/...s-weaponize-social-media-to-pressure-victims/

Minimalist · Dec 18, 2021

The Week in Ransomware - December 17th 2021 - Enter Log4j

A critical Apache Log4j vulnerability took the world by storm this week, and now it is being used by threat actors as part of their ransomware attacks.
Click to expand...

https://www.bleepingcomputer.com/ne...in-ransomware-december-17th-2021-enter-log4j/

guest · Dec 23, 2021

mood said: ↑

UK’s Police Federation hit by ransomware
March 21, 2019
https://techcrunch.com/2019/03/21/police-federation-ransomware/
Click to expand...

Up to 120,000 Cops May Have Legal Claim Over 2019 Breach
December 23, 2021

Lawyers are seeking a “group litigation order” against the Police Federation (PFEW) over a 2019 ransomware breach which they say may have impacted 120,000 officers.

Keller Lenkner UK said it served notice this week to the staff association for police constables, sergeants, inspectors and chief inspectors in England and Wales. It intends to seek the order from the High Court in early 2022.
Click to expand...

As reported by Infosecurity at the time, the PFEW’s IT systems were first hit on March 9 2019, and then again ten days later.
It claimed that several databases and systems at its Surrey headquarters had been affected.

“Back-up data has been deleted and has been encrypted and became inaccessible. Email services were disabled and files were inaccessible,” an FAQ statement noted.
This may have led to personal and financial data theft from members. The law firm is also alleging that the PFEW didn’t inform members until a fortnight after the breach, despite GDPR obligations to the contrary.
Click to expand...

guest · Dec 24, 2021

Ransomware attack on French IT service provider Inetum
December 24, 2021

As of Sunday, December 19, 2021, there appears to have been a successful cyberattack using ransomware against French IT services provider Inetum. The attack affected the group's IT functions in France, but not in other countries, the company wrote. With 2 billion euros in annual revenue and 19,000 employees (2018), that's already one of the big ones in the industry.

I came across this security incident via the following tweet. But the incident is also made public by Inetum here.
Click to expand...

The company later announced that sites outside France were not affected. None of the main infrastructures, communication and collaboration tools or delivery operations for Inetum customers were affected. Within the affected area, all servers were isolated and customers' VPNs were turned off.
Click to expand...

Inetum: Cyberattack on Inetum in France

As announced on Monday, 20 December 2021, the Inetum Group was the target of a ransomware cyberattack on Sunday, 19 December 2021, which impacted certain operations in France, but not in any of the other countries where the Group operates.
Click to expand...

guest · Dec 24, 2021

The Week in Ransomware - December 24th 2021 - No rest for the weary
December 24, 2021

The holiday season is here, but there is no rest for our weary admins as ransomware gangs are still conducting attacks over the Christmas and New Years breaks.

This is especially true this year, with the rampant Log4j exploitation over the past few weeks leading to compromised networks that are ripe for ransomware deployment while the workforce is on vacation.
Network admins and security researchers are already reporting that BlackCat/ALPHV affiliates continue to attack the enterprise today as we move into the Christmas weekend, so it is vital to keep an eye on your networks and respond quickly to unusual behavior. [...]
Click to expand...

guest · Dec 26, 2021

Hellmann Warns Customers They Could Face Malicious Communications Following Attack
December 24, 2021

German logistics provider Hellmann Worldwide Logistics has warned customers social engineering attacks could target them after being hit by a ransomware attack earlier this month.

In an update on the incident, which forced the company to take its IT systems temporarily offline on December 9, Hellmann confirmed that the attackers extracted data. While it is still investigating what type of data was stolen, the firm warned its partners and customers to beware of fraudulent emails and calls “in particular regarding payment transfers, changing bank details or the like.”
Click to expand...

Hellmann stated:

“As reported, the forensic investigation has confirmed that data was extracted from our servers before our systems were temporarily taken offline as a precautionary measure on December 9. We are currently investigating what type of data was extracted. Should we receive indications that third parties are affected, we will inform them proactively. We are in regular contact with relevant government authorities.”
Click to expand...

guest · Dec 27, 2021

QNAP NAS devices hit in surge of ech0raix ransomware attacks
December 27, 2021

Users of QNAP network-attached storage (NAS) devices are reporting attacks on their systems with the eCh0raix ransomware, also known as QNAPCrypt.

The threat actor behind this particular malware intensified their activity about a week before Christmas, taking control of the devices with administrator privileges.
Click to expand...

Attack count jumps before Christmas
BleepingComputer forum users managing QNAP and Synology NAS systems have been regularly reporting eCh0raix ransomware attacks but more of them started to disclose incidents around December 20.
The jump in the number of attacks is confirmed by the ID ransomware service, where submissions started to increase on December 19 and subsided towards December 26.

The initial infection vector remains unclear at the moment. Some users admit they were reckless and did not secure the device properly (e.g. expose it to the internet over an insecure connection); others claim a vulnerability in QNAP’s Photo Station allowed the attackers to wreak havoc.
Click to expand...

guest · Jan 7, 2022

New Mexico's Bernalillo County Investigates Ransomware Attack
January 6, 2022

New Mexico's Bernalillo County closed most county buildings on Jan. 5 after a suspected ransomware attack targeted its systems.

Bernalillo County is the most populous in New Mexico and includes the cities of Albuquerque, Los Ranchos, and Tijeras. Officials report the disruption likely occurred between midnight and 5:30 a.m. on Jan. 5. They have taken affected systems offline and severed network connections, as well as notified county system vendors, which are working to solve the issue and restore system functionality.
Read more details here.
Click to expand...

guest · Jan 7, 2022

The Week in Ransomware - January 7th 2022 - Watch out for USB drives
January 7, 2022

With the holidays these past two weeks, there have been only a few known ransomware attacks and little research released.

At the end of December, a new enterprise-targeting ransomware operation called Night Sky was launched, but it is not very active so far.
We also saw an increase in Qlocker and eCh0raix campaigns targeting QNAP NAS devices, leading to QNAP releasing a security advisory.
Click to expand...

The most noteworthy information that came out today is a new FBI flash alert warning that REvil and BlackMatter were sending malicious USB drives to defense firms that deployed ransomware.

Finally, there have been a few ransomware attacks over the past two weeks, including FinalSite, Bernalillo County, and SIC.
Click to expand...

Minimalist · Jan 14, 2022

The Week in Ransomware - January 14th 2022 - Russia finally takes action

Today, the Russian government announced that they arrested fourteen members of the REvil ransomware gang on behalf of US authorities.

While the ransomware gang members are only being charged with "illegal circulation of means of payment," the arrests are the first public action by Russia to stem the activities of ransomware gangs operating within the country.
Click to expand...

https://www.bleepingcomputer.com/ne...anuary-14th-2022-russia-finally-takes-action/

Minimalist · Jan 21, 2022

The Week in Ransomware - January 21st 2022 - Arrests, Wipers, and More

It has been quite a busy week with ransomware, with law enforcement making arrests, data-wiping attacks, and the return of the Qlocker ransomware.
Click to expand...

https://www.bleepingcomputer.com/ne...re-january-21st-2022-arrests-wipers-and-more/

Minimalist · Jan 29, 2022

The Week in Ransomware - January 28th 2022 - Get NAS devices off the Internet

It's been a busy week with ransomware attacks tied to political protests, new attacks on NAS devices, amazing research released about tactics, REvil's history, and more.

This week's biggest news is about a new ransomware operation called DeadBolt encrypted QNAP devices worldwide, illustrating how threat actors can still earn a lot of money by targeting consumers and small businesses.
Click to expand...

https://www.bleepingcomputer.com/ne...y-28th-2022-get-nas-devices-off-the-internet/

Minimalist · Feb 4, 2022

The Week in Ransomware - February 4th 2022 - Critical Infrastructure

Critical infrastructure suffered ransomware attacks, with threat actors targeting an oil petrol distributor and oil terminals in major ports in different attacks.
Click to expand...

https://www.bleepingcomputer.com/ne...re-february-4th-2022-critical-infrastructure/

Minimalist · Feb 5, 2022

FBI shares Lockbit ransomware technical details, defense tips

The Federal Bureau of Investigation (FBI) has released technical details and indicators of compromise associated with LockBit ransomware attacks in a new flash alert published this Friday.

It also provided information to help organizations block this adversary's attempts to breach their networks and asked victims to urgently report such incidents to their local FBI Cyber Squad.
Click to expand...

https://www.bleepingcomputer.com/ne...it-ransomware-technical-details-defense-tips/

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Ransomware and Recent Variants

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches