Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood · Feb 3, 2020

DoppelPaymer Ransomware Sells Victims' Data on Darknet if Not Paid
February 3, 2020
https://www.bleepingcomputer.com/ne...re-sells-victims-data-on-darknet-if-not-paid/

The DoppelPaymer Ransomware is the latest family threatening to sell or publish a victim's stolen files if they do not pay a ransom demand.

This new tactic started in November 2019 when Maze Ransomware publicly released stolen files belonging to Allied Universal for not paying a ransom.
Since then, Sodinokibi/REvil published stolen data and the Nemty Ransomware announced in their RaaS affiliate panel that they would start doing it as well.

It is now DoppelPaymer's turn, who has told BleepingComputer that they have sold victim's data on the darknet in the past when they did not pay the ransom.
Click to expand...

DoppelPaymer claims to sell victim's data
When looking at the DoppelPaymer Tor payment site, BleepingComputer noticed that they had recently started to tell victims that they have stolen their data and will to publish or sell it if a ransom is not paid.

In emails with the DoppelPaymer Ransomware operators, the threat actors told BleepingComputer that for almost a year they have been stealing data from their victims. They also claimed to have anonymously sold stolen files on the darknet in the past when a victim chose not to pay the ransom.
DoppelPaymer begins using a new extension
Recent versions of the DoppelPaymer ransomware have also switched to a new dedicated .doppeled extension for encrypted files.
BleepingComputer was told by the DoppelPaymer operators that this was done to make it easier for victims to know what ransomware encrypted their network.
Click to expand...

mood · Feb 4, 2020

Warning to law firms: a ransomware group is stealing data and posting it online
February 3, 2020
https://blog.emsisoft.com/en/35486/...group-is-stealing-data-and-posting-it-online/

Five law firms have been hit by a notorious ransomware group known as Maze – three within the last 72 hours alone. It is highly likely Maze will target more law firms in the days and weeks ahead. While only U.S. firms have so been hit, firms in other countries are equally at risk.
In staying true to Maze’s typical modus operandi, the cybergang didn’t simply encrypt the law firms’ data – they also stole it.

Maze initially names its victims and, if that is not sufficient to extract payment, publishes a small portion of their data online. This simply serves as proof that they have the data and is the equivalent of a kidnapper sending a pinky finger.
In regard to the recent attacks, Maze has already posted a portion of least two of the firms’ stolen data, which includes client information.
Click to expand...

While Maze claims that the stolen data will be deleted upon payment, it would be a mistake to assume that that this will be done. Why would a criminal enterprise delete data that it may be able to further monetize?
Click to expand...

mood · Feb 6, 2020

Maze Ransomware Hackers Extorting Providers, Posting Stolen Health Data
February 4, 2020
https://healthitsecurity.com/news/m...xtorting-providers-posting-stolen-health-data

Recent reports have shown the hacking group behind Maze ransomware has been steadily posting the data of its victims online after the organizations fail to pay the ransom demand. A compiled list of victims shows the data of several healthcare organizations are included in those postings, despite a lack of public reporting of those incidents.

The FBI issued a warning in early January that the hackers behind Maze ransomware have increased targeted attacks on the private sector.
Beginning late last year, the Maze hackers began notifying sites like DataBreaches.net that it exfiltrated the data from its victims during the ransomware attacks and had been holding onto that sensitive information to later publish, if those organizations did not respond to their extortion demands.

In one of the most notable cases, Southwire, a cable and wire manufacturer out of Georgia, fell victim to Maze ransomware and refused to pay the $1.7M or 200 BTC demand. The hackers then went on to publish the stolen data [...]The site was taken down in less than 24 hours after the judge issued the order. However, Maze hackers registered two site domains and continued publishing the stolen data from Southwire.
Click to expand...

One of the largest medical data postings appears to be from New Jersey’s Medical Diagnostics Laboratories (MD Lab).
When MD Lab refused to pay the extortion demand, the hackers went on to publish 9.5 GB of research data in an attempt to force negotiations with the provider.

About 29 companies are listed on the Maze website as organizations that have not paid the hackers. And the actors still have samples posted of the data they have claimed to have stolen.
Click to expand...

mood · Feb 7, 2020

Backing up is no panacea when blackmailers publish stolen data
Ransomware makers seem to be following a new trend, publishing data from companies that refuse to pay them
February 6, 2020
https://www.kaspersky.com/blog/ransomware-data-disclosure/32410/

Backing up data has been one of the most effective, though labor-intensive, safeguards against encrypting ransomware so far. Now, malefactors seem to have caught up with those who rely on backups. The creators of several ransomware programs, confronted with victims refusing to pay the ransom, shared their data online.
Maze was the first
Unlike its predecessors, the group behind Maze ransomware delivered on its promises in late 2019 — more than once. In November, when Allied Universal refused to pay up, the criminals leaked 700MB of internal data online including contracts, termination agreements, digital certificates, and more.
Next came Sodinokibi, Nemty, BitPyLock
Other cybercriminals followed. [...]
Click to expand...

It is worrisome that there is no safeguarding oneself against these attacks with backups. If you are infected, there is no way for you to avoid losses, which will not necessarily be limited to ransom; blackmailers provide no guarantees. The only way to protect yourself is not to let malware into your systems.
Click to expand...

mood · Feb 26, 2020

Sodinokibi Ransomware May Tip NASDAQ on Attacks to Hurt Stock Prices
February 26, 2020
https://www.bleepingcomputer.com/ne...y-tip-nasdaq-on-attacks-to-hurt-stock-prices/

The operators of the Sodinokibi Ransomware (REvil) have started urging affiliates to copy their victim's data before encrypting computers so it can be used as leverage on a new data leak site that is being launched soon.

According to the post shared with BleepingComputer by Damian, the ransomware operators have finished a 'blog' that will be used to distribute unpaid victim's stolen data, with some data like Social Security numbers being held back to be sold on dark markets for a 'fairly high rate of return'.
Further laying their plans out in the open, Unknown speculates on other ways that they can further pressure victims to pay a ransom.

The full posted translated from Russian can be read below: [...]
As part of this post, they also linked to a 10MB stolen data dump of one of their victims that they claim contains financial and tax information. They go on to state that they will add more to this data dump if the victim does not pay.
Click to expand...

Minimalist · Feb 27, 2020

Nemty Ransomware Actively Distributed via 'Love Letter' Spam

Security researchers have spotted an ongoing malspam campaign using emails disguised as messages from secret lovers to deliver Nemty Ransomware payloads on the computers of potential victims.
Click to expand...

https://www.bleepingcomputer.com/ne...re-actively-distributed-via-love-letter-spam/

mood · Feb 28, 2020

Sodinokibi Ransomware Posts Alleged Data of Kenneth Cole Fashion Giant
February 28, 2020
https://www.bleepingcomputer.com/ne...s-alleged-data-of-kenneth-cole-fashion-giant/

The operators behind Sodinokibi Ransomware published download links to files containing what they claim is financial and work documents, as well as customers' personal data stolen from giant U.S. fashion house Kenneth Cole Productions.
Kenneth Cole is a privately held fashion firm headquartered in New York, founded 38 years ago, in 1982, and known as "one of the world’s most recognized fashion companies."
Threats of publishing all Kenneth Cole stolen data
The ransomware operators claim to have possession of a huge archive of over 70,000 documents with financial and work data, and more than 60,000 records with Kenneth Cole customers' personal information according to the Sodinokibi actors as a researcher at Under the Breach discovered.

Sodinokibi also threatens to publish the full data cache if the American fashion house fails to reply to their ransom requests until the ransom's timer runs out.

"Kenneth Cole Productions, you have to hurry," the ransomware operators said. "When time is up and there is no feedback from you, the entire cloud data will be published, including your customers' personal data."
Click to expand...

mood · Mar 1, 2020

Visser, a parts manufacturer for Tesla and SpaceX, confirms data breach
March 1,2020
https://techcrunch.com/2020/03/01/visser-breach/

A precision parts maker for space and defense contractors has confirmed a “cybersecurity incident,” which TechCrunch has learned was likely caused by ransomware.

Visser Precision, a Denver, Colorado-based manufacturer, makes custom parts for a number of industries, including automotive and aeronautics. In a brief statement, the company confirmed it was “the recent target of a criminal cybersecurity incident, including access to or theft of data.”
The company said it “continues its comprehensive investigation of the attack, and business is operating normally,” a spokesperson told TechCrunch.

Security researchers say the attack was caused by the DoppelPaymer ransomware, a new kind of file-encrypting malware which first exfiltrates the company’s data. The ransomware threatens to publish the stolen files if the ransom is not paid.
Click to expand...

Brett Callow, a threat analyst at security firm Emsisoft, first alerted TechCrunch to the website that was publishing files stolen by the DoppelPaymer ransomware.

“Data theft is a strategy that multiple groups have now adopted and, consequently, ransomware incidents should be treated as data breaches until it can be established they are not,” said Callow.
Click to expand...

mood · Mar 2, 2020

Maze posts data allegedly stolen from PEI in ransomware attack
March 2, 2020
https://vancouversun.com/technology...tack/wcm/ad5a33af-c53a-41d0-878b-9e4f35a5bb59

Brett Callow, a British Columbia-based threat analyst for Emsisoft who has seen the files, said they were posted over the weekend. That’s a week after PEI discovered and stopped a ransomware attack 90 minutes after it started.

In the PEI case the posted spreadsheets, PDFs, text and ZIP files are under a headline that reads”Proofs.” Callow says the files he’s seen include person’s names and social insurance numbers, copies of provincial bank statements, audits and budgets.
The public Maze site has listed a number of alleged successful ransomware attacks, but later some of their names have been erased. That suggests those organizations paid up, Callow said.

Data theft as a weapon for blackmail or ransom is increasingly being added to the toolbox of threat actors because it can increase the odds of payment
Click to expand...

mood · Mar 2, 2020

Nemty Ransomware Punishes Victims by Posting Their Stolen Data
March 2, 2020
https://www.bleepingcomputer.com/ne...unishes-victims-by-posting-their-stolen-data/

The Nemty Ransomware is the latest cybercrime operation to create a data leak site to punish victims who refuse to pay ransoms.

Once Maze Ransomware followed through with their threat and posted stolen files, other ransomware families such as DoppelPaymer and Sodinokibi started to launch leak sites to extort victims in a similar manner.
In a new site shared with BleepingComputer by Damien, the Nemty Ransomware operators have started to punish their non-paying victims by releasing files that were stolen before devices were encrypted.

As more ransomware operators begin to utilize this extortion tactic, victims will need to consider all ransomware attacks a data breach. This means file noticed with the government, alerting affected people, and sending out breach notifications.
Click to expand...

mood · Mar 7, 2020

Ransomware Threatens to Reveal Company's 'Dirty' Secrets
March 7, 2020
https://www.bleepingcomputer.com/ne...e-threatens-to-reveal-companys-dirty-secrets/

The operators of the Sodinokibi Ransomware are threatening to publicly share a company's "dirty" financial secrets because they refused to pay the demanded ransom.

In a new post by the Sodinokibi operators to their data leak site, we can see that attackers are not only publishing victim's data but also sifting through it to find damaging information that can be used against the victim.
In the above post, the attackers are threatening to sell the Social Security Numbers and date of births for people in the data to other hackers on the dark web.

They also intimate that they found "dirty" financial secrets in the data and threaten to disclose it.
These new extortion attempts further illustrate how victims need to treat ransomware attacks very seriously.
Click to expand...

mood · Mar 17, 2020

New Nefilim Ransomware Threatens to Release Victims' Data
March 17, 2020
https://www.bleepingcomputer.com/ne...ransomware-threatens-to-release-victims-data/

A new ransomware called Nefilim that shares much of the same code as Nemty has started to become active in the wild and threatens to release stolen data.

Nefilim became active at the end of February 2020 and while it not known for sure how the ransomware is being distributed, it is most likely through exposed Remote Desktop Services.
Head of SentinelLabs Vitali Krimez and ID Ransomware's Michael Gillespie both told BleepingComputer that Nefilim and Nemty 2.5 share much of the same code.
Nefilim threatens to release data
In the Nefilim ransom note, the attackers state that if a user does not pay the ransom in seven days they will release data that was stolen from the network.

A large amount of your private files have been extracted and is kept in a secure location.
If you do not contact us in seven working days of the breach we will start leaking the data.
After you contact us we will provide you proof that your files have been extracted.
Click to expand...

Unfortunately, a brief analysis by Gillespie indicates that this ransomware appears to be secure, which means that there is no current way to recover files for free.
The ransomware, though, is still being researched and if new weaknesses we will publish updated information.
Click to expand...

mood · Mar 19, 2020

Sodinokibi Ransomware Data Leaks Now Sold on Hacker Forums
March 19, 2020
https://www.bleepingcomputer.com/ne...somware-data-leaks-now-sold-on-hacker-forums/

Ransomware victims who do not pay a ransom and have their stolen files leaked are now facing a bigger nightmare as other hackers and criminals sell and distribute the released files on hacker forums.

Recently, the Sodinokibi Ransomware operators published over 12 GB of stolen data allegedly belonging to a company named Brooks International for not paying the ransom.
While making the data publicly accessible is bad enough, BleepingComputer has been told by cyber-intelligence firm Cyble that other hackers and criminals have started to distribute and sell this data on hacker forums.

From screenshots of the files shared with BleepingComputer, this stolen data is very valuable to hackers as it contains user names and passwords, credit card statements, alleged tax information, and much more.
Click to expand...

BleepingComputer reached out to Brooks International by phone to warn them about the distribution of their data and ask related questions, but after speaking to someone never received a phone call back.
Ransomware attacks are data breaches
To make matters worse, it is not only corporate data being exposed, but also employee's personal information being stolen. These employees need to be informed of these breaches so that they can protect themselves from identity theft.
Unfortunately, too many ransomware attacks go undisclosed, even to the employees who are impacted.
Click to expand...

mood · Mar 23, 2020

Ameren Missouri Equipment Supplier Targeted In Ransomware Attack
March 23, 2020
https://news.stlpublicradio.org/post/ameren-missouri-equipment-supplier-targeted-ransomware-attack

Ransomware attackers have stolen data from a third-party vendor that supplies utility equipment to Ameren Missouri power plants.

Dozens of data files from Ohio-based LTI Power Systems appeared on a ransomware server in late February, including equipment diagrams and schematics from two Ameren Missouri facilities. No customer information appears to have been involved in the data breach.
The files include detailed schematics of uninterruptible power supply equipment, used to provide temporary backup power during outages.

“This particular incident is, in my view, all about the theft of intellectual property and making it available for sale to nation states or other companies,” Scherrer said.
This type of data breach has become increasingly common across a wide range of sectors.
Click to expand...

mood · Mar 24, 2020

Three More Ransomware Families Create Sites to Leak Stolen Data
March 24, 2020
https://www.bleepingcomputer.com/ne...re-families-create-sites-to-leak-stolen-data/

Three more ransomware families have created sites that are being used to leak the stolen data of non-paying victims and further illustrates why all ransomware attacks must be considered data breaches.

Ever since Maze created their "news" site to publish stolen data of their victims who choose not to pay, other ransomware actors such as Sodinokibi/REvil, Nemty, and DoppelPaymer have been swift to follow.
Over the past two days, BleepingComputer has learned of another three ransomware families who have now launched their data leak sites, which are listed below.
Click to expand...

Nefilim Ransomware
The Nefilim Ransomware has launched a site called "Corporate Leaks" that is being used to dump the data of victims who do not pay a ransom.
Nefilim is fairly new and is believed to be a new version of the Nemty Ransomware.
CLOP Ransomware
The CLOP Ransomware has also released a leak site called "CL0P^_- LEAKS" that they are using to publish stolen data for non-paying victims.
The CLOP Ransomware made news recently after it attacked the Maastricht University and was paid 30 bitcoins to recover their data.
Sekhmet Ransomware
Finally, a relatively new ransomware called Sekhmet has also released a data leak site called "Leaks leaks and leaks".
Not much is known about this ransomware other than that their ransom note is named "RECOVER-FILES.txt".
Click to expand...

mood · Mar 26, 2020

Chubb Cyber Insurer Allegedly Hit By Maze Ransomware Attack
March 26, 2020
https://www.bleepingcomputer.com/ne...urer-allegedly-hit-by-maze-ransomware-attack/

Cyber insurer giant Chubb is allegedly the latest ransomware victim according to the operators of the Maze Ransomware who claim to have encrypted the company in March 2020.
Chubb is one of the leading insurance carriers in the world with an extensive line of cyber insurance products that include incident response, forensics, legal teams, and even public relations.
Maze claims they encrypted Chubb's network
In a new entry on their Maze 'News' site, the ransomware operators claim to have encrypted devices on Chubb's network in March, 2020.
As part of these attacks, the Maze operators will steal a company's files before encrypting their network. These stolen files will then be used as leverage by threatening to publicly release it if a ransom is not paid.

While no data has been published yet, the Maze operators have included the email addresses of executives such as CEO Evan Greenberg, COO John Keogh, and Vice Chairman John Lupica. This information, though, should not be considered proof of encryption as the emails are readily available on public websites.
Click to expand...

The Maze operators have told BleepingComputer that they are not providing any details of the attack at this time.
We will update this article when more information becomes available.
Click to expand...

mood · Mar 30, 2020

Medical and military contractor Kimchuk hit by data-stealing ransomware
March 26, 2020
https://techcrunch.com/2020/03/26/kimchuk-medical-military-ransomware/

Kimchuk, a medical and military electronics maker, has been hit by data-stealing ransomware, TechCrunch has learned.

Its systems were infected and knocked offline earlier this month by DoppelPaymer, a newer strain of ransomware that exfiltrates data out of an infected network before encrypting user files. If a victim doesn’t pay the ransom to decrypt their files, the DoppelPaymer group will begin publishing the contents of their victim’s network.
When the company did not pay, the hackers began publishing portions of Kimchuk’s network.

It isn’t known precisely when the ransomware attack happened. But a screenshot of a directory of stolen files seen by TechCrunch puts the most recent file at March 5, suggesting the attack happened on or around then.
TechCrunch contacted Kimchuk for comment.
Click to expand...

Kimchuk chief executive Jim Marquis responded to our email — without taking us off the email chain — instructing his human resources and operations chiefs to “not respond” to our email or questions.

“If he persists, state ‘no comment’,” Marquis wrote. “How did he learn of this?”
We followed up, asking Marquis if he wanted to provide a fuller statement. TechCrunch did not hear back.

Given the breach happened on a government supply chain, we contacted the Dept. of Defense. When reached, a spokesperson did not comment.
Click to expand...

mood · Mar 31, 2020

A Malware Researcher’s Guide to Reversing Maze Ransomware
March 30, 2020
https://labs.bitdefender.com/2020/03/a-malware-researchers-guide-to-reversing-maze/

Unlike run-of-the-mill commercial ransomware, Maze authors implemented a data theft mechanism to exfiltrate information from compromised systems. This information is used as leverage for payment and to transform an operational issue into a data breach.
We were curious about the executable, and how it tried to achieve System privileges.

Further investigation revealed that the process belongs to the Maze/ChaCha ransomware, so we took a deeper look.
We documented our findings in a whitepaper that attempts to shed some light on how Maze performs evasion, exploitation,obfuscation and finally, system encryption.
Click to expand...

Bitdefender: "A Technical Look into Maze Ransomware" (PDF - 5.03 MB):
https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf

mood · Apr 6, 2020

Maze ransomware group hacks oil giant; leaks data online
April 6, 2020
https://www.hackread.com/maze-ransomware-group-hacks-oil-giant-leaks-data/

On April 1st, 2020, Berkine became a victim of cyber-attack by the notorious Maze ransomware group that is known for its unique blackmailing practices.

The attackers managed to steal the entire database containing over 500MB of confidential documents related to budgets, organizational strategies, production quantities, and similar sensitive data.
The Maze ransomware group leaked the database containing information about the Sonatrach oil firm.

According to Under the Breach, a service that exclusively monitors data breaches and works for its prevention stated that the documents posted online are related to financial details and investment plans of the company.
The database also contains a list of Berkine employees including their contact details and travel documents of some of them.
Click to expand...

The maze ransomware group has quickly become the biggest threat to organizations around the world. The French National Agency for Security of Information Systems (ANSSI) examined this group after it attacked a subsidiary of Bouygues in January 2020.

The Maze ransomware, assessed ANSSI, is a variant of the ChaCha20 cryptographic algorithm, which is one of the most feared data encryption software.
Moreover, the group keeps releasing some of the data and even post it on hacker forums for phishing purposes if the victim doesn’t give in to their demands.
Click to expand...

mood · Apr 14, 2020

RagnarLocker ransomware hits EDP energy giant, asks for €10M
April 14, 2020
https://www.bleepingcomputer.com/ne...ansomware-hits-edp-energy-giant-asks-for-10m/

Attackers using the Ragnar Locker ransomware have encrypted the systems of Portuguese multinational energy giant Energias de Portugal (EDP) and are now asking for a 1580 BTC ransom ($10.9M or €9.9M).
EDP Group is one of the largest European operators in the energy sector (gas and electricity) and the world's 4th largest producer of wind energy.
Attackers threaten to leak 10 TB of stolen documents
During the attack, the Ragnar Locker ransomware operators claim to have stolen over 10 TB of sensitive company files and they are now threatening the company to leak all the stolen data unless the ransom is paid.

"We had downloaded more than 10TB of private information from EDP group servers," a new post on Ragnarok's leak site says.
Among the already leaked files published as a sign of what's to come, the attackers included an edpradmin2.kdb file which is a KeePass password manager database.
Click to expand...

According to the ransom note dropped on the EDP encrypted systems, the attackers were able to steal confidential information on billing, contracts, transactions, clients, and partners.
"And be assure that if you wouldn't pay, all files and documents would be publicated for everyones view and also we would notify all your clients and partners about this leakage with direct links," the ransom note reads.
EDP taunted in the live chat room
‏As also seen BleepingComputer, the Ragnar Locker operators also taunted EDP in a live chat "client room" used by the attackers to communicate with their victims [...]
They also add "timer is not waiting" and EDP is also warned not to attempt to decrypt their data using any other software besides the decryption tool provided by the Ragnar Locker operators as they risk damaging or losing it.
Delivered via MSP enterprise support tools
Ragnar Locker ransomware was first spotted while being used as part of attacks against compromised networks towards the end of December 2019.
Click to expand...

mood · Apr 16, 2020

‘Double Extortion’ Ransomware Attacks Spike
More ransomware operators are setting up pages where they threaten to publish compromised data from victims
April 16, 2020
https://threatpost.com/double-extortion-ransomware-attacks-spike/154818/

Victims of ransomware attacks now face a double whammy of headaches. Cybercriminals are increasingly inflicting more pain on ransomware victims by threatening to leak compromised data or use it in future spam attacks, if ransom demands aren’t met.

The ransomware tactic, call “double extortion,” first emerged in late 2019 by Maze operators – but has been rapidly adopted over the past few months by various cybercriminals behind the Clop, DopplelPaymer and Sodinokibi ransomware families.

“Double Extortion is a clear and growing ransomware attack trend,” Lotem Finkelsteen, manager of threat intelligence with Check Point Research, said in a Thursday analysis. “We saw a lot of this in Q1 of 2020. In this tactic, threat actors corner their victims even further by dripping sensitive information into the darkest places in the web to substantiate their ransom demands.”
Click to expand...

A November 2019 ransomware attack against Allied Universal, a large American security staffing company, set the precedent for “double extortion.”
To prove the validity of the threat, the threat actors leaked 700 MB worth of data [...]

Now, researchers say that, TA2101, the group behind the Maze ransomware, have since created a dedicated web page which lists the identities of their non-cooperative victims and regularly publishes samples of the stolen data.

Research experts warn that “double extortion” attacks will continue to hit ransomware victims in 2020 [...]
“We’re especially worried about hospitals having to face this threat,” said researchers. “With their focus on coronavirus patients, addressing a double extortion ransomware attack would be very difficult. We issue caution to hospitals and large organization, surging them to back up their data and educate their staff.”
Click to expand...

Check Point Research: Ransomware Evolved: Double Extortion

mood · Apr 21, 2020

Here's a list of all the ransomware gangs who will steal and leak your data if you don't pay
April 21, 2020
https://www.zdnet.com/article/heres...ill-steal-and-leak-your-data-if-you-dont-pay/

Starting with late 2019 and early 2020, the operators of several ransomware strains have begun adopting a new tactic.
In an attempt to put additional pressure on hacked companies to pay ransom demands, several ransomware groups have also begun stealing data from their networks before encrypting it.

While initially the tactic was pioneered by the Maze ransomware gang in December 2019, it is now becoming a widespread practice among other groups as well.
At the time of writing, ZDNet has identified nine ransomware operations that are currently running or have maintained a "leak site," either on the dark web, or the public internet.

Below is a list of all ransomware "leak sites," in alphabetical order, which we'll maintain going forward, as an index of all groups that engage in this tactic. We will not be linking to any of these sites, nor will we be listing any past or present victims.
Click to expand...

CLOP

DOPPELPAYMER

MAZE

NEFILIM

NEMTY

RAGNARLOCKER

REVIL (SODINOKIBI)

SEKHMET

SNATCH

Minimalist · Apr 22, 2020

DoppelPaymer Ransomware hits Los Angeles County city, leaks files

The City of Torrance of the Los Angeles metropolitan area, California, has allegedly been attacked by the DoppelPaymer Ransomware, having unencrypted data stolen and devices encrypted.

The attackers are demanding a 100 bitcoin ($689,147) ransom for a decryptor, to take down files that have been publicly leaked, and to not release more stolen files.
Click to expand...

https://www.bleepingcomputer.com/ne...are-hits-los-angeles-county-city-leaks-files/

mood · Apr 23, 2020

Maze Ransomware – What you Need to Know
April 23, 2020
https://www.tripwire.com/state-of-security/featured/maze-ransomware-what-you-need-to-know/

Maze is a particularly sophisticated strain of Windows ransomware that has hit companies and organisations around the world, demanding a cryptocurrency payment be made in return for the safe recovery of encrypted data.
But what makes Maze more dangerous is that it also steals the data it finds, exfiltrating it to servers controlled by malicious hackers who then threaten to release it if a ransom is not paid. Increasingly other ransomware (such as REvil, also known as Sodinokibi) has been observed using similar tactics.
HOW MUCH INFORMATION DOES THE MAZE RANSOMWARE TYPICALLY STEAL FROM A COMPANY?
It’s hard to say – as only the companies concerned and the criminals themselves will know how much has been taken. However, the Maze website has this to say:

“Usually we have over 100Gb of data from single client. Sometimes up to 10Tb of commercial and private information. We are looking for NDA marked information and everything that can be used as a base for the lawsuit agains our client.
WAIT. YOU MENTIONED THIS BEFORE. THE MAZE GUYS HAVE A WEBSITE?
The website includes details of when victims had their computer systems hit by the Maze ransomware, as well as links to downloads of stolen data and documents as “proof.”
There are even convenient buttons on the website to share details of breaches via social media.
Click to expand...

mood · Apr 23, 2020

Online leak undermines Torrance’s claim that no personal data was affected by cyberattack
April 22, 2020
https://www.scmagazine.com/home/sec...no-personal-data-was-affected-by-cyberattack/

BleepingComputer has reported that the attackers demanded a 100 ransom — which falls a bit short of $700,000 — after decrypting key files and exfiltrating breached data under the threat of publishing it.

In a March 1 press release set up on a temporary website, Torrance acknowledged the attack in generic terms, referring to an incident as a “digital compromise interrupting email accounts and server function,” resulting in the disruption of some city business services. Ransomware was not specifically cited as the cause.
In that statement, the city asserted that “Public personal data has not been impacted.” But if DoppelPaymer’s new post is, indeed, authentic, then this statement is wrong.

“I don’t know why governments make these hasty claims,” Callow told SC Media. “A more accurate statement would be, ‘We’ve been hit by a ransomware group which is known to steal data, but cannot yet say whether our data was stolen. [...]'”
Click to expand...

However, Michael Smith, public information officer with Torrance, told SC Media that “Our initial press release still stands [on] its merits,” also noting that “there’s no update at this point.”
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

Can ransomware write to unmounted drives?

Attackers Prefer Ransomware to Stealing Data

Ransomware Deployment Trends

DoppelPaymer Ransomware Launches Site to Post Victim's Data

Ransomware Impacting Pipeline Operations

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

Can ransomware write to unmounted drives?

Attackers Prefer Ransomware to Stealing Data

Ransomware Deployment Trends

DoppelPaymer Ransomware Launches Site to Post Victim's Data

Ransomware Impacting Pipeline Operations

Useful Searches