Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Jan 1, 2021

More Than 114,000 Patients Affected by Wilmington Surgical Associates Ransomware Attack
December 31, 2020
https://www.hipaajournal.com/more-t...ington-surgical-associates-ransomware-attack/

In October 2020, the NetWalker ransomware gang claimed responsibility for a ransomware attack on the North Carolina-based surgical center, Wilmington Surgical Associates. The gang claimed to have stolen around 13GB of data prior to deploying NetWalker ransomware and encrypting files. The stolen batch of data included thousands of documents containing sensitive information.

HIPAA Journal has not yet been able to obtain a copy of the breach notification; however, the ransomware attack has now appeared on the HHS’ Office for Civil Rights breach portal and shows the PHI of 114,834 patients was compromised in the attack.
Click to expand...

Other healthcare providers attacked with NetWalker ransomware this year include the Crozer-Keystone Health System in Philadelphia, the Champaign-Urbana Public Health District in Illinois, and Brno University Hospital in the Czech Republic. The group also targets universities and was behind the 2020 ransomware attacks on Michigan State University and Columbia College of Chicago
Click to expand...

guest · Jan 1, 2021

Trucking giant Forward Air hit by new Hades ransomware gang
December 21, 2020
https://www.bleepingcomputer.com/ne...forward-air-hit-by-new-hades-ransomware-gang/

Trucking and freight logistics company Forward Air has suffered a ransomware attack by a new ransomware gang that has impacted the company's business operations.

Last week, FreightWaves reported that Forward Air suffered a cyberattack that forced them to take their systems offline to prevent the attack's spread. Forward Air later confirmed this attack in a statement to BleepingComputer.

"On December 15, Forward Air detected an IT security incident that impacted the functionality of certain computer systems. Per our information security protocols, we immediately took our systems offline, notified law enforcement and engaged several third-party experts to assist us in conducting an internal investigation. [...]" Forward Air shared in a statement to BleepingComputer.
According to FreightWaves, the attack has led to business disruption as the paperwork required to release freight from customs was stored on the shutdown systems and is not available.
Click to expand...

New Hades ransomware operation is responsible.
Sources have told BleepingComputer today that Forward Air suffered a cyberattack by a new ransomware operation known as Hades.

Update 12/21/20 6:37 PM EST: After we published our story, Forward Air filed a Form 8-K with the Securities and Exchange Commission disclosing that they suffered a ransomware attack.
Click to expand...

Hades ransomware – a cryptovirus that asks to contact attackers via TOX instant messaging service

Hades ransomware is a file-locking cyber threat that is made to extort money by encrypting data on victims' computers and forcing them into buying a necessary decryption tool. During encryption, all files are appended with five alphanumeric characters that represent the victims' ID.

Before Hades file virus starts data encryption, it archives and uploads it to remote servers controlled by cybercriminals to hold hostage. Victims can find about that by visiting the assailants' website using ixltdyumdlthrtgx.onion website on TOR or by using an alternative communication method – TOX service, which is known for its anonymity.

Before Hades file virus starts data encryption, it archives and uploads it to remote servers controlled by cybercriminals to hold hostage.
Click to expand...

guest · Jan 4, 2021

mood said: ↑

Metro Vancouver’s transit system hit by ransomware attack
December 3, 2020
https://globalnews.ca/news/7499986/translink-suspicious-network-activity-update/
Click to expand...

TransLink confirms ransomware data theft, still restoring systems
January 4, 2021
https://www.bleepingcomputer.com/ne...ansomware-data-theft-still-restoring-systems/

Metro Vancouver's transportation agency TransLink has confirmed that the Egregor ransomware operators who breached its network at the beginning of December 2020 also accessed and potentially stolen employees' banking and social security information.

TransLink announced on December 1, 2020, that the transportation network was experiencing issues with their computing systems following a cyberattack.
Click to expand...

TransLink told employees in an internal email seen by Global News that the Egregor operators have "accessed and may have copied files from a restricted network drive" and several other network drives.

According to the email, the accessed drives containing the payroll information of TransLink, Coast Mountain Bus Company (CMBC), and Metro Vancouver Transit Police employees.

"Those restricted network drives include files that contain banking information and some social insurance numbers," TransLink added.
While the company has evidence that the drives were accessed during the attack, it is still working on identifying the impacted employees and the files that were opened or copied by the attackers.
Click to expand...

Most systems still down
"We are now in the process of gradually bringing priority systems back online as safely as possible," Murphy added.

Unfortunately we're not able to confirm this information at this time, as most of our systems remain unavailable after a cyberattack. We're recommending using Google trip planner for the time being, but that also won't be updated for Winter service changes until tomorrow. ^nv
— TransLink BC | Masks Mandatory (@TransLink) January 3, 2021
Click to expand...

guest · Jan 6, 2021

Babuk Locker is the first new enterprise ransomware of 2021
January 5, 2021
https://www.bleepingcomputer.com/ne...-the-first-new-enterprise-ransomware-of-2021/

It's a new year, and with it comes a new ransomware called Babuk Locker that targets corporate victims in human-operated attacks.

Babuk Locker is a new ransomware operation that launched at the beginning of 2021 and has since amassed a small list of victims from around the world.
From ransom negotiations with victims seen by BleepingComputer, demands range from $60,000 to $85,000 in Bitcoin.
Click to expand...

According to security researcher Chuong Dong who also analyzed the new ransomware, Babuk Locker's coding is amateurish but includes secure encryption that prevents victims from recovering their files for free.

"Despite the amateur coding practices used, its strong encryption scheme that utilizes Elliptic-curve Diffie–Hellman algorithm has proven effective in attacking a lot of companies so far," Dong stated in his report.
Unfortunately, Dong says that the ransomware's use of ChaCha8 and Elliptic-curve Diffie–Hellman (ECDH) makes the ransomware secure and not decryptable for free.
Click to expand...

Uses hacker forum to leak stolen data
Most ransomware operations that utilize this tactic have created public ransomware data leak sites to publish stolen data.
However, Babuk Locker is currently using a hacker forum to leak their stolen data

In a post to the hacker forum, the Babuk Locker representative states that they will soon launch a dedicated leak site.
Click to expand...

guest · Jan 8, 2021

Dassault Falcon Jet reports data breach after ransomware attack
January 8, 2021
https://www.bleepingcomputer.com/ne...-reports-data-breach-after-ransomware-attack/

Dassault Falcon Jet has disclosed a data breach that may have led to the exposure of personal information belonging to current and former employees, as well as their spouses and dependents.

Dassault Falcon Jet is the US subsidiary of French aerospace company Dassault Aviation which designs and builds military aircraft, business jets, and space systems.
Subsidiaries also impacted
Dassault Falcon Jet discovered the incident on December 6th, 2020, and sent a data breach notification letter to impacted current and former employees on December 31st.
According to media reports and the dates of breach reported by the company, the attackers maintained access to Dassault Falcon Jet's systems for roughly six months, between June 6th and December 7th.
Click to expand...

The information belonging to employees may include their "name, personal and company email address, personal mailing address, employee ID number, driver’s license number, passport information, financial account number, Social Security number, date of birth, work location, compensation and benefit enrollment information, and date of employment."

Their spouses and dependents' information may include their "name, address, date of birth, Social Security number, and benefit enrollment information."
Impacted systems restored and rebuild
While the company has not yet confirmed that the breach was due to a ransomware attack, LeMagIT reported in December that Ragnar Locker is the ransomware gang that was behind the incident.
Click to expand...

Dassault Falcon Jet spokespersons were not immediately available for comment when contacted by BleepingComputer earlier today.
The company also didn't provide a reply to inquiries made by BleepingComputer last month.

The Ragnar Locker gang sent BleepingComputer the following screenshot on December 11th, 2020, containing a directory listing from one of the Dassault Falcon Jet systems breached during the attack (a heavily redacted version is available below).
Click to expand...

guest · Jan 16, 2021

Data Stolen in ‘Promutuel’ Insurance Firm Attack Now Leaking Online
January 14, 2021
https://www.technadu.com/data-stolen-promutuel-insurance-firm-attack-leaking-online/240586/

The Quebec-based insurance company ‘Promutuel Assurance’ has recently suffered a ransomware attack, which crippled its systems and prevented its customers from accessing their accounts through the online platform. To complete the catastrophe, the confidential details of some of the company’s customers have now leaked online, as we can confirm with the help of KELA’s dark web crawlers.

The company, which has around 630,000 customers, played down the data leak, saying that it’s only a set of 15 files that don’t contain any highly sensitive information like social insurance numbers, driver’s licenses, credit card numbers, or any banking information.
Also, reports of local media outlets accuse Promutuel of denying to share more information about the incident and claim that the customers haven’t received a notification about the possibility of their information being compromised.
Click to expand...

Promutuel has made some reassuring statements on “LaPresse,” saying that no amount will be withdrawn from the clients’ bank accounts without first sending a written communication to them at least twenty days in advance.

Finally, although the ransomware group responsible for this incident hasn’t been confirmed, we are seeing evidence of “DoppelPaymer” being involved, as they were the first to release the data on their extortion portal.
Click to expand...

guest · Jan 28, 2021

mood said: ↑

SunCrypt Ransomware shuts down North Carolina school district
September 4, 2020
https://www.bleepingcomputer.com/ne...re-shuts-down-north-carolina-school-district/
Click to expand...

North Carolina School System Sends Data Breach Notices
January 25, 2021
https://www.govtech.com/security/North-Carolina-School-System-Sends-Data-Breach-Notices.html

Hundreds of current and former Haywood County Schools employees got letters this month informing them their private information could have been compromised in a cyberattack against the school system.

A cybercriminal ring hacked the school's servers in August and attempted to blackmail the school system into paying a ransom in exchange for unlocking the network — including a threat that the hackers would post the data they obtained on the dark web if the school system didn't pay up.

"If there was any potential the hackers got anything on that person, we sent them a letter," Superintendent Dr. Bill Nolte said. "We thought it was better to notify unnecessarily than to not notify."
Click to expand...

The school board decided not to pay the cyberransom under advisement from investigators, as doing so only emboldens hackers to go after others. Even if the school system had paid up, the security monitoring service would have still been necessary.
Click to expand...

Minimalist · Feb 4, 2021

Meet Babuk, a ransomware attacker blamed for the Serco breach

Someone calling themselves “biba99” on a popular criminal forum claimed on Jan. 5 to provide “non-malicious” software to help organizations identify “security issues.” The author struggled to explain, in halting English, “why we are not…criminals” while assuring readers that the group would not hack hospitals or schools.

A month later, the attacker behind what appeared to be a bumbling forum post is reportedly claiming responsibility for a ransomware attack on the multibillion-dollar outsourcing firm Serco.
Click to expand...

https://www.cyberscoop.com/babuk-ransomware-serco-attack/

guest · Feb 6, 2021

mood said: ↑

Trucking giant Forward Air hit by new Hades ransomware gang
December 21, 2020
https://www.bleepingcomputer.com/ne...forward-air-hit-by-new-hades-ransomware-gang/

Hades ransomware – a cryptovirus that asks to contact attackers via TOX instant messaging service
Click to expand...

Forward Air Corporation says that December Ransomware attack caused a loss of $7.5M
February 5, 2021
https://securityaffairs.co/wordpress/114259/malware/forward-air-corporation-ransomware.html

Trucking and freight transportation logistics giant Forward Air Corporation announced that the ransomware attack that hit the company in December will impact its fourth-quarter financial results.

The security breach is expected to cause a loss $7.5 million of LTL revenue.
Forward Air did not reveal details on the attack such as the family of ransomware that infected its systems.
Click to expand...

hawki · Mar 19, 2021

"REvil Ransomware Targets Acer’s Microsoft Exchange Server

The notorious REvil ransomware gang recently targeted a Microsoft Exchange server on Taiwanese PC giant Acer’s domain...

REvil claimed on their leak site Thursday that they had broken into and stolen Acer’s unencrypted data...

The REvil attack would represent an escalation in the massive campaign against Microsoft Exchange servers...

The REvil affiliate behind the Acer attack demanded a $50 million ransom...

On their public leak site, REvil posted alleged images from Acer’s financial spreadsheets, bank balances, and bank communications. The $50 million ask of Acer is the largest-ever ransom demand to become publicly known..."

https://www.crn.com/news/security/revil-ransomware-targets-acer-s-microsoft-exchange-server-source

guest · Apr 26, 2021

Avaddon Ransomware Group Hit the Small Italian Municipality of Villafranca d’Asti
April 26, 2021
https://www.technadu.com/avaddon-ra...ian-municipality-of-villafranca-dasti/268953/

The small town of Villafranca in northern Italy has suffered an Avaddon ransomware attack.

The actors have stolen sensitive documents and have already published alarming samples.

The municipality is threatened with DDoSing if its officials don’t negotiate the payment of a ransom.

Click to expand...

The Town of Villafranca d’Asti, a small Italian municipality in northern Italy that has a total population of just over three thousand people, has suffered a ransomware attack during the weekend. The actors are of the Avaddon gang, who are already leaking sensitive documents on their dark web portal.

The documents that the actors claim to be holding include financial documents, agreements, contracts, banking documents, payment invoices, applications, permits, ID cards, medical records, personal documents, and many more. The sample documents and screenshots that have been leaked appear to be authentic, and many of the things posted on Avaddon’s portal is quite recent, so the compromise is fresh, no doubt.
The documents that concern PII of employees and citizens should have been adequately protected against data breaches and leaks, but they weren’t.
Click to expand...

guest · Apr 26, 2021

DC Police confirms cyberattack after ransomware gang leaks data
April 26, 2021
https://www.bleepingcomputer.com/ne...cyberattack-after-ransomware-gang-leaks-data/

The Metropolitan Police Department has confirmed that they suffered a cyberattack after the Babuk ransomware gang leaked screenshots of stolen data.

The Metropolitan Police Department, also known as the DC Police or MPD, is the primary law enforcement agency for Washington, DC, the US capital.
In a statement to BleepingComputer, the DC Police stated that they are aware of a breached server and that the FBI is investigating the matter.

"We are aware of unauthorized access on our server. While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter." - Metropolitan Police Department.
Click to expand...

This statement comes after the Babuk Locker gang said they had compromised the DC Police's networks and stolen 250 GB of unencrypted files.

"We will not comment this time: Even such an organization has huge security gaps, we advise them to get in touch as soon as possible and pay us, otherwise we will publish this data," stated the Babuk ransomware gang on their data leak site.
Click to expand...

guest · Apr 28, 2021

UK rail network Merseyrail likely hit by Lockbit ransomware
April 28, 2021
https://www.bleepingcomputer.com/ne...-merseyrail-likely-hit-by-lockbit-ransomware/

UK rail network Merseyrail has confirmed a cyberattack after a ransomware gang used their email system to email employees and journalists about the attack.

"We can confirm that Merseyrail was recently subject to a cyber-attack. A full investigation has been launched and is continuing. In the meantime, we have notified the relevant authorities," Merseyrail told BleepingComputer yesterday after we received a mysterious email earlier this month from the account of Andy Heath, the Director of Merseyrail.
Ransomware gang uses Merseyrail's email system against them
While the cyberattack has not been publicly disclosed, BleepingComputer learned of the attack after receiving a strange email on April 18th from Heith email account with the mail subject, "Lockbit Ransomware Attack and Data Theft."

Included in the email is a link to an image showing an employee's personal information that Lockbit allegedly stole during the attack.
Click to expand...

hawki · Apr 28, 2021

mood said: ↑

DC Police confirms cyberattack after ransomware gang leaks data
April 26, 2021
https://www.bleepingcomputer.com/ne...cyberattack-after-ransomware-gang-leaks-data/
Click to expand...

"Hackers publish extensive dossiers on D.C. police officers in extortion attempt...

The files, each of which is around 100 pages long, are marked "Background Investigation Documents" and labeled 'confidential,' alongside the department’s seal. They include a vast array of personal information, as well as arrest history, housing and financial records, polygraph results and extensive details about their training and work background..."

https://www.nbcnews.com/tech/securi...s-dc-police-officers-extortion-attemp-rcna788

guest · Apr 29, 2021

Whistler resort municipality hit by new ransomware operation
April 29, 2021
https://www.bleepingcomputer.com/ne...municipality-hit-by-new-ransomware-operation/

The Whistler municipality in British Columbia, Canada, has suffered a cyberattack at the hands of a new ransomware operation.

The Resort Municipality of Whistler (RMOW) is a resort community with approximately 12,000 residents and over three million visitors annually.
Whistler hit by new ransomware gang
Yesterday, the Resort Municipality of Whistler (RMOW) suffered a ransomware attack that forced them to shut down their network, website, email, and phone systems.
Click to expand...

While the attack was ongoing, the Whistler.ca website was hacked to display a message stating that the site was under construction and that visitors should contact support at an included Tor dark web URL.
This URL leads to a dark web chat site used by the attackers to negotiate a ransom payment with Whistler and to prevent the leaking of stolen files.

This message indicates that RMOW's network has been encrypted and that unencrypted files were stolen during the attack, which has become common in ransomware attacks.
The website is one that neither BleepingComputer nor ransomware researchers we spoke to have seen before, indicating it is likely a new ransomware operation.
Click to expand...

guest · Apr 30, 2021

Brazil's Rio Grande do Sul court system hit by REvil ransomware
April 29, 2021
https://www.bleepingcomputer.com/ne...-do-sul-court-system-hit-by-revil-ransomware/

Brazil's Tribunal de Justiça do Estado do Rio Grande do Sul was hit with an REvil ransomware attack yesterday that encrypted employee's files and forced the courts to shut down their network.

Soon after the attack started, the official TJRS Twitter account warned employees not to log in to the TJ network's systems locally or via remote access.

"The TJRS informs that it faces instability in computer systems. The systems security team advises internal users not to access computers remotely, nor to log into computers within the TJ network," tweeted the TJRS court system.
Click to expand...

These ransom notes are for the REvil ransomware operation, which BleepingComputer has independently confirmed was responsible for the attack.
BleepingComputer was told that the REVil ransomware operation demanded a $5,000,000 ransom to decrypt files and not leak data.
Click to expand...

guest · Apr 30, 2021

‘Groupe Reorev’ Breached by the ‘LV’ Ransomware Actors
April 29, 2021
https://www.technadu.com/groupe-reorev-breached-lv-ransomware-actors/270239/

A new ransomware group known as “LV” claims to have stolen 400GB of sensitive data from Groupe Reorev.

The actors have leaked out some sample documents, but those aren’t very important or damaging.

The most worrying part is the client data and technical documents, as Reorev has many high-profile customers.

Click to expand...

The ransomware group that goes by the name “LV” has announced what is maybe their most prestigious hit to date, as they claim to have compromised the corporate network of Groupe Reorev.

The actors claim to have exfiltrated 400GB of sensitive data that includes documents relevant to finance, accounting, banking, insurance, client data, and technical data. The last two sound like the riskiest of all for Reorev, as having the details of your customers or your patented technology leaked publicly is always a regrettable incident and one that’s hard to recuperate from.
We have checked some of the samples that the LV actors have published on their Tor site, and there doesn’t seem to be anything really sensitive or apocalyptic in there.
Click to expand...

The LV group was first noticed in November 2020, so it’s a fairly recent actor that appeared to be using the same ransomware as REvil (Sodinokibi). It was never determined if the LV is an affiliate separate program or just stole REvil’s malware somehow. Since LV didn’t have any “big hits” until now, it never received much attention from the researchers’ community.

The main problem remains the stolen data and what exactly could the LV actors be holding.
Click to expand...

guest · May 2, 2021

Presque Isle police await hackers’ next move with stolen data after ransom deadline passes
April 29, 2021
https://bangordailynews.com/2021/04...ith-stolen-data-after-ransom-deadline-passes/

The ransom time clock on the Presque Isle Police Department’s ransomware attack ran out Wednesday at about 9:30 p.m. in a dramatic red-numbered countdown of minutes and seconds racing toward zero on the hacker’s dark web site.

Following an April 18 hack of the city’s server, the Avaddon Ransomware-related cybergang threatened to begin dumping the Presque Isle Police Department files on the dark web if police did not comply with the undisclosed amount of ransom request.

“The incident was reported to the FBI,” City Manager Martin Puckett said on Tuesday after confirming there was unauthorized access into the police department’s server. “We were able to restore from a daily backup.”
Click to expand...

In the Presque Isle incident, the Avaddon-related gang said that when the police department’s 10 days to pay were up, it would start dumping confidential documents.
So far, the only documents on the Avaddon site are the police records posted since the initial threat which include victim statements, domestic violence incident reports, victim’s personal information, information on gun purchases, other police reports and business documents.
Click to expand...

guest · May 3, 2021

N3TW0RM ransomware emerges in wave of cyberattacks in Israel
May 3, 2021
https://www.bleepingcomputer.com/ne...re-emerges-in-wave-of-cyberattacks-in-israel/

A new ransomware gang known as 'N3TW0RM' is targeting Israeli companies in a wave of cyberattacks starting last week.

Israeli media Haaretz reported that at least four Israeli companies and one nonprofit organization had been successfully breached in this wave of attacks.
Like other ransomware gangs, N3TW0RM has created a data leak site where they threaten to leak stolen files as a way to scare their victims into paying a ransom.

Two of the Israeli businesses, H&M Israel and Veritas Logistic's networks, have already been listed on the ransomware gang's data leak, with the threat actors already leaking data allegedly stolen during the attack on Veritas.
Click to expand...

A WhatsApp message shared among Israeli cybesrecurity researchers also states that the N3TW0RM ransomware shares some characteristics with the Pay2Key attacks conducted in November 2020 and February 2021.

Haaretz reports that Veritas' ransom demand was three bitcoin, or approximately $173,000, while another ransom note shared with BleepingComputer shows a ransom demand of 4 bitcoins, or roughly $231,000.
Unusual client-server model to encryption
When encrypting a network, threat actors will usually distribute a standalone ransomware executable to every device they wish to encrypt.
N3TW0RM does it a bit differently by using a client-server model instead.
Click to expand...

guest · May 4, 2021

The REvil Ransomware Gang Lists Three New Engineering Makers as Victims
May 4, 2021
https://www.technadu.com/revil-ransomware-gang-three-new-engineering-makers-victims/271947/

REvil has listed three big engineering companies on its press release portal.

All three have a long history and a global market presence, being considered leaders in their fields.

None has admitted any data breaches yet, and none has announced any production problems either.

Click to expand...

REvil’s press release Tor site called “Happy Blog” has just been enriched with three new victims, all companies that engage in the engineering manufacturing field making specialized products for the international market. The victims are Lydall, Keyence, and Asarco, and in all cases, we can see the publication of sensitive documents that appear to belong to employees of these companies.

More specifically, the REvil has let out national ID cards, passports, certificates, and salary lists. In one case, we can also see a mutual non-disclosure agreement.
Click to expand...

None of the three websites of the allegedly victimized entities have any apparent problem, and we can see no announcements of a data breach or any production hiccups from any of them.
We have reached out to all three companies asking for a comment, so we will update this post once we hear back from any of them.
Click to expand...

guest · May 5, 2021

Telstra service provider hit by cyber attack as hackers claim SIM card information stolen
May 4, 2021
https://www.news.com.au/technology/...n/news-story/2ff32b2e3634506882102e9c9d012994

Hackers have claimed they have gained access to “tens of thousands” of SIM cards after a cyber attack against an Australian telecom firm.

The victim, Melbourne-based Schepisi Communications, describes itself as a “platinum partner” of Telstra that supplies phone numbers and cloud storage services on behalf of the telecommunications giant.

“We have a large amount of data on mobile devices, tens of thousands of SIM cards … financial information, contracts, banking information,” the ransom note read.
Telstra confirmed there had been a security breach that affected one of its “dealers”.
Click to expand...

Among Schepisi’s customers that appeared to have had their information exposed were global food conglomerate Nestle, a Melbourne radio station, an Australian property management firm, and a financial services company based in Victoria.

The criminals implored the company to “communicate and co-operate” before then or “valuable company documents” would be leaked.
Brett Callow, threat analyst with the cyber security firm Emsisoft, said the hackers were using a “triple-pronged” mode of attack by stealing data, encrypting that information so that it couldn’t be accessed without the hackers’ help, and shutting down the victim’s website.
Click to expand...

guest · May 8, 2021

Ransomware gangs have leaked the stolen data of 2,100 companies so far
May 8, 2021
https://www.bleepingcomputer.com/ne...ed-the-stolen-data-of-2-100-companies-so-far/

Since 2019, ransomware gangs have leaked the stolen data for 2,103 companies on dark web data leaks sites.

Between the threat of not recovering their encrypted files and the additional concerns of data breaches, government fines, and lawsuits, threat actors are banking on the idea that this would force victims to more readily pay a ransom.
34 ransomware gangs leak data on the dark web
A dark web security researcher known as DarkTracer has been keeping track of the data leak sites for thirty-four ransomware gangs and told BleepingComputer that they have now leaked the data for 2,103 organizations.

The 34 ransomware gangs followed by DarkTracer are Team Snatch, MAZE, Conti, NetWalker, DoppelPaymer, NEMTY, Nefilim, Sekhmet, Pysa, AKO, Sodinokibi (REvil), Ragnar_Locker, Suncrypt, DarkSide, CL0P, Avaddon, LockBit, Mount Locker, Egregor, Ranzy Locker, Pay2Key, Cuba, RansomEXX, Everest, Ragnarok, BABUK LOCKER, Astro Team, LV, File Leaks, Marketo, N3tw0rm, Lorenz, Noname, and XING LOCKER.
Click to expand...

Of these thirty-four operations, the top five active operations are Conti (338 leaks), Sodinokibi/REvil (222 leaks), DoppelPaymer (200 leaks), Avaddon (123 leaks), and Pysa (103 leaks).
Three groups that are no longer active and have more leaks than some of those in the top five are Maze (266 leaks) and Egregor (206 leaks).

The data for all the ransomware gang's data leak sites are represented in the chart below created by DarkTracer from May 4th, 2021.
Click to expand...

guest · May 10, 2021

Japanese Power Tool Maker ‘Yamabiko’ Claimed as Victim by Babuk
May 10, 2021
https://www.technadu.com/japanese-power-tool-maker-yamabiko-claimed-victim-babuk/273865/

The Babuk ransomware gang has returned to ‘normal operations,’ claiming another victim.

The compromised company is ‘Yamabiko,’ a Japanese toolmaker with a worldwide reach.

The actors claim to have stolen 0.5 TB of sensitive data and are already leaking out some documents.

Click to expand...

The Babuk ransomware gang has added ‘Yamabiko Corporation’ in its data leak portal, claiming to have stolen 0.5 TB of sensitive data from the Japanese power tool maker. The hackers are presenting screenshots of accessed filesystems, Solidworks files, personal employee data, financial reports, testing diagrams, circuit schematics, etc. The leaked files appear to be valid, and some of them feature the letterhead of Yamabiko or its brands, but so far, there has been no official admission of an incident.

After all, Babuk has previously stated that they will no longer focus on encrypting any files on the victimized networks. As such, Yamabiko shouldn’t have any front-facing trouble due to a ransomware attack by that group.
Click to expand...

The problem remains solely the stolen data and the possibility to leak it publicly. We have contacted the company asking for a comment, and we will update this post once we hear back from them.
Click to expand...

guest · May 11, 2021

Ransomware gang leaks data from Metropolitan Police Department
May 11, 2021
https://www.bleepingcomputer.com/ne...aks-data-from-metropolitan-police-department/

Babuk Locker ransomware operators have leaked personal files belonging to police officers from the Metropolitan Police Department (also known as MPD or DC Police) after negotiations went stale.

The documents published on Babuk Locker's dark web leak portal include 150 MB worth of data from DC Police officers' personal files.

"The negotiations reached a dead end, the amount we were offered does not suit us, we are posting 20 more personal files on officers, you can download this archive, the password will be released tomorrow," Babuk Locker said.
Click to expand...

guest · May 11, 2021

200K Veterans’ Medical Records Likely Stolen by Ransomware Gang
Analyst finds ransomware evidence, despite a contractor’s denial of compromise.
May 11, 2021
https://threatpost.com/veterans-medical-records-ransomware/166025/

A database filled with the medical records of nearly 200,000 U.S. military veterans was exposed online by a vendor working for the Veterans Administration, according to an analyst, who also presented evidence the data might have been exfiltrated by ransomware attackers.

The files were first discovered on April 18 by researcher Jeremiah Fowler, who found the database sitting exposed online without even basic password protection. Fowler said the files made several references to United Valor Solutions.

“The database was set to open and visible in any browser (publicly accessible) and anyone could edit, download or even delete data without administrative credentials,” Fowler said about his findings.
Click to expand...

Ransomware Demand Detected In Dataset
“The dataset also contained a ransomware message titled “read_me” that claimed all of the records were downloaded and they would be leaked unless 0.15 Bitcoin ($8,148) was paid,” Fowler explained. “The forensic audit or IP review of outside access conducted by the contractor should have also identified the ransomware intrusion and the multiple internet-of-things (IoT) search-engine spiders that indexed the exposed database. This appears to contradict what the contractors told United Valor.”
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches