Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Jul 15, 2021

This ransomware gang hunts for evidence of crime to pressure victims into paying a ransom
July 15, 2021
https://www.zdnet.com/article/this-...ime-to-pressure-victims-into-paying-a-ransom/

A prolific ransomware group that targets organisations around the world looks for sensitive info and files that suggest its victims are aware of illegal activity, with the aim of exploiting this as additional leverage in their hunt to make money from ransom payments.

The Mespinoza ransomware group – also known as PYSA – demands millions of dollars in exchange for a decryption key and threatens to publish private information stolen from the compromised network if the victims don't pay.
Click to expand...

Cybersecurity company Palo Alto Networks has analysed Mespinoza attacks and detailed what it describes as an "extremely disciplined" ransomware group, which actively searches for evidence of illegal activity as well as other sensitive information to use as blackmail for double extortion campaigns.

"They search using sensitive terms such as illegal, fraud, and criminal. In other words, the actors are also interested in illegal activities known to the organisation that could provide extreme leverage should a negotiation start," Alex Hinchliffe, threat intelligence analyst for Unit 42 at Palo Alto Networks, told ZDNet.
The ransom demands are often over $1.5 million, but the group is willing to negotiate with victims and has received many payments of almost $500,000 in exchange for a decryption key as well as to prevent stolen information from being published.
Click to expand...

Palo Alto Networks - Unit42: Gasket and MagicSocks Tools Install Mespinoza Ransomware

Here are some our our key findings on the Mespinoza gang:

Extremely Disciplined: After accessing a new network, the group studies compromised systems in what we believe is triage to determine whether there’s enough valuable data to justify launching a full-scale attack. They look for keywords including clandestine, fraud, ssn, driver*license, passport and I-9. That suggests they are hunting for sensitive files that would have the most impact if leaked.

Targets Many Industries: Victim organizations are referred to as “partners.” Use of that term suggests that they try to run the group as a professional enterprise and see victims as business partners who fund their profits. The gang’s leak site provided data it claims belong to 187 victim organizations in industries including education, manufacturing, retail, medical, government, high tech, transportation and logistics, engineering and social services, among others.

Click to expand...

Has Global Reach: 55 percent of victims identified on the leak site are in the United States. The rest are scattered across the globe in more than 20 countries including Canada, Brazil, United Kingdom, Italy, Spain, France, Germany, South Africa and Australia.

Is Cocky When Approaching Victims: A ransom note offers this advice: “What to tell my boss?” “Protect Your System, Amigo.”

Uses Attack Tools with Creative Names: A tool that creates network tunnels to siphon off data is called “MagicSocks.” A component stored on their staging server and likely used to wrap up an attack is named “HappyEnd.bat.”

Click to expand...

guest · Jul 18, 2021

Ecuador's state-run CNT telco hit by RansomEXX ransomware
July 17, 2021
https://www.bleepingcomputer.com/ne...te-run-cnt-telco-hit-by-ransomexx-ransomware/

Ecuador's state-run Corporación Nacional de Telecomunicación (CNT) has suffered a ransomware attack that has disrupted business operations, the payment portal, and customer support.

"Today, July 16, 2021, the National Telecommunications Corporation, CNT EP, filed a complaint with the State Attorney General's Office for the crime of “attack on computer systems "so that the preliminary investigation is carried out and the responsible," read the alert translated into English.
CNT suffers RansomEXX ransomware attack
While CNT has not officially stated that they suffered a ransomware attack, BleepingComputer has learned that the attack was conducted by a ransomware operation known as RansomEXX.

Security researcher Germán Fernández shared with BleepingComputer a hidden link to the group's data leak site that warns CNT that the gang would leak data stolen during the attack if CNT did not pay a ransom.
Click to expand...

In CNT's press statement, the company states that corporate and customer data are secure and have not been exposed.
However, the RansomEXX gang claims to have stolen 190 GB of data and shared screenshots of some of the documents on the hidden data leak page.
Click to expand...

ronjor · Jul 19, 2021

Don’t Wanna Pay Ransom Gangs? Test Your Backups.
July 19, 2021
This story isn’t about what organizations do in response to cybercriminals holding their data for hostage, which has become something of a best practice among most of the top ransomware crime groups today. Rather, it’s about why victims still pay for a key needed to decrypt their systems even when they have the means to restore everything from backups on their own.
Click to expand...

https://krebsonsecurity.com/2021/07/dont-wanna-pay-ransom-gangs-test-your-backups/

guest · Jul 22, 2021

Chat logs show how Egregor, an $80 million ransomware gang, handled negotiations with little mercy
July 21, 2021
https://www.cyberscoop.com/egregor-chat-logs-ibm-ransomware-negotiations/

“The Egregor Team wishes you a Merry Christmas and a Happy New Year,” they’d say at intervals of their chat room communications, sometimes in the middle of an extortion back-and-forth. “We wish you wisdom in your decision making and financial stability in this difficult time for us all. Happy Holidays!”

In another exchange, they weren’t as kind, threatening to leak victims’ data and publish it on a website as a warning to other organizations that might fall in the group’s crosshairs.

“We simply need to determine what category you should be placed in. In the category of those who are ready to negotiate and pay or in the category of scarecrows on our news site,” one exchange read. “It’s not so important for us in what role you will serve us.”
Click to expand...

Egregor has since disappeared, following an international sting in February. Now, though, more than 100 pages of Egregor negotiation transcripts — obtained and analyzed by IBM Security X-Force and its partner company Cylera, and reviewed by CyberScoop — shed light on the oft-opaque structure of a ransomware operation.
Click to expand...

IBM X-Force: This Chat is Being Recorded: Egregor Ransomware Negotiations Uncovered

Key Takeaways
Despite the holiday wishes and reduced ransom in some instances, the December 2020 chat logs obtained by X-Force and Cylera demonstrate that many Egregor attacks were a successful, ruthless criminal operation.

Although the threat actors have ceased from using the Egregor ransomware family specifically, and only since the law enforcement activity in February 2021, X-Force analysts believe that a new infrastructure can be mounted and the same code can be used again in its original form or as modified code. Moreover, with these attacks yielding extremely high profits for those residing in less prosperous parts of the world, new ransomware families and gangs will continue to emerge and may take Egregor’s place in the near future.
Click to expand...

guest · Jul 22, 2021

740 ransomware victims named on a data breach site in the second quarter of 2021
July 22, 2021
https://fuentitech.com/740-ransomwa...ch-site-in-the-second-quarter-of-2021/147680/

In the second quarter of 2021, more than 700 organizations were attacked by ransomware and posted data to data leak sites. New research report From cybersecurity company Digital Shadows.

Of the approximately 2,600 victims listed on the ransomware data breach site, 740 were named in the second quarter of 2021, an increase of 47% compared to the first quarter.
The report records the major events of the quarter.
Click to expand...

Digital Shadows tracks information posted on 31 dark web leak sites and gives you access to the number of groups that stole data and posted online during a ransomware attack.
Ransomware attacks were the largest increase in the retail sector, with Digital Shadows researchers finding an increase of 183% between the first and second quarters.

On the activity side, Conti Group took the lead, followed by Abadon, PYSA and REvil.
Click to expand...

guest · Jul 27, 2021

LockBit ransomware automates Windows domain encryption via group policies
July 27, 2021
https://www.bleepingcomputer.com/ne...windows-domain-encryption-via-group-policies/

A new version of the LockBit 2.0 ransomware has been found that automates the encryption of a Windows domain using Active Directory group policies.

When threat actors breach a network and finally gain control of the domain controller, they utilize third-party software to deploy scripts that disable antivirus and then execute the ransomware on the machines on the network.
In samples of the LockBit 2.0 ransomware discovered by MalwareHunterTeam and analyzed by BleepingComputer and Vitali Kremez, the threat actors have automated this process so that the ransomware distributes itself throughout a domain when executed on a domain controller.
Click to expand...

As the ransomware will be executed using a UAC bypass, the program will run silently in the background without any outward alert on the device being encrypted.

"This is the first ransomware operation to automate this process, and it allows a threat actor to disable Microsoft Defender and execute the ransomware on the entire network with a single command," Kremez told BleepingComputer.
"The malware added a novel approach of interacting with active directory propagating ransomware to local domains as well as built-in updating global policy with anti-virus disable making "pentester" operations easier for new malware operators."
Click to expand...

LockBit 2.0 print bombs network printers
LockBit 2.0 also includes a feature previously used by the Egregor Ransomware operation that print bombs the ransom note to all networked printers.
When the ransomware has finished encrypting a device, it will repeatedly print the ransom note to any connected network printers to get the victim's attention, as shown below.
Click to expand...

guest · Jul 28, 2021

BlackMatter ransomware group claims to be Darkside and REvil succesor
July 28, 2021
https://securityaffairs.co/wordpress/120611/malware/blackmatter-ransomware.html

Lile other ransomware operations, BlackMatter also set up its leak site where it will publish data exfiltrated from the victims before encrypting their system.

The birth of the BlackMatter ransomware was first spotted by researchers at Recorded Future who also reported that the gang is setting up a network of affiliates using ads posted on two cybercrime forums, such as Exploit and XSS.
The group is recruiting crooks with access to the networks of large enterprises, which have revenues of $100 million/year or larger, in an attempt to infect them with its ransomware.
Click to expand...

BlackMatter ransomware operators announced that they will not target healthcare organizations, critical infrastructure, organizations in the defense industry, and non-profit companies.

“The group boasted about having the ability to encrypt different operating system versions and architectures. This includes the likes of Windows systems (via SafeMode), Linux (Ubuntu, Debian, CentOS), VMWare ESXi 5+ virtual endpoints, and network-attached storage (NAS) devices (such as Synology, OpenMediaVault, FreeNAS, and TrueNAS).” reported The Record.
Recorded Future researchers believe that there is a link between BlackMatter and the now-defunct Darkside group.
Click to expand...

Recorded Future: BlackMatter ransomware targets companies with revenue of $100 million and more

New BlackMatter ransomware group claims to be Darkside and REvil succesor.

The group is willing to pay up to $100,000 for access to large corporate networks.

The BlackMatter gang says it won't attack hospitals, critical infrastructure, non-profits, and government organizations.

Click to expand...

guest · Jul 28, 2021

German county targeted by ransomware asks military for help
July 27, 2021
https://www.euractiv.com/section/cy...argeted-by-ransomware-asks-military-for-help/

Following the ransomware attack, several servers of the district administration in eastern Germany were infected, which led to access to data and services being restricted. To keep the administration’s most important servers running, a state of emergency was called and an emergency infrastructure set up.

“The Armed Forces are now to assist us with forensics and with the restructuring and installation of the new infrastructure, which is independent of the old network. Administrative assistance has been requested, but so far the answer is still pending,” the district’s press officer told EURACTIV.
The hackers are asking for a ransom in exchange for the release of the encrypted data, according to the State Criminal Police Office in Saxony-Anhalt, but the district refused to comply.
Click to expand...

But according to a statement by the district, some of the stolen data has already been published on the Darknet.
Click to expand...

guest · Jul 28, 2021

mood said: ↑

BlackMatter ransomware group claims to be Darkside and REvil succesor
July 28, 2021
https://securityaffairs.co/wordpress/120611/malware/blackmatter-ransomware.html

Recorded Future: BlackMatter ransomware targets companies with revenue of $100 million and more
Click to expand...

Haron and BlackMatter are the latest groups to crash the ransomware party
July 28, 2021
https://arstechnica.com/gadgets/202...2-new-ransomware-groups-hunting-for-big-game/

Both groups say they are aiming for big-game targets, meaning corporations or other large businesses with the pockets to pay ransoms in the millions of dollars.
Haron: like Avaddon. Or maybe not
The first group is calling itself Haron. A sample of the Haron malware was first submitted to VirusTotal on July 19. Three days later, South Korean security firm S2W Lab discussed the group in a post.

Most of the group’s site on the dark web is password protected by extremely weak credentials. Once past the login page, there’s a list of alleged targets, a chat transcript that’s not fit to be shown in full, and the group’s explanation of its mission.
The similarity on its own isn’t especially meaningful. It could mean that the creator of the Haron site had a hand in administering the Avaddon site.
Click to expand...

itman · Jul 28, 2021

Ransomware wars on the horizon?

Babuk Ransomware Gang Ransomed, New Forum Stuffed With Porn

A comment spammer flooded Babuk’s new ransomware forum with gay orgy porn GIFs and demanded $5K in bitcoin.

The Babuk ransomware gang’s new rebrand isn’t going so well. It seems the cybercriminal group has been a victim of a ransomware attack of its own.

Babuk’s latest endeavor, a Dark Web ransomware forum called RAMP, was crippled by a spammer over the weekend who overloaded the site with same-sex pornographic GIFs, according to Recorded Future.

The attacker told Babuk they wanted $5,000. Babuk told them to pound sand, refused to pay and deleted the original post. But even after wiping the forum several times, Recorded Future said the attacker was still able to bombard the forum with pornographic GIFs.
Click to expand...

https://threatpost.com/babuk-ransomware-gang-ransomed-forum-stuffed-porn/168169/

EASTER · Jul 28, 2021

Now that ransomware actors have turned on one another, things might be about to get even more interesting.
Click to expand...

Freaking hilarious What's good for the goose is just right for the gander.

guest · Jul 29, 2021

Grief ransomware operation is DoppelPaymer rebranded
July 29, 2021
https://www.bleepingcomputer.com/news/security/grief-ransomware-operation-is-doppelpaymer-rebranded/

After a period of little to no activity, the DoppelPaymer ransomware operation has made a rebranding move, now going by the name Grief (a.k.a. Pay or Grief).

It is unclear if any of the original developers are still behind this ransomware-as-a-service (RaaS) but clues uncovered by security researchers point to a continuation of the “project.”
With no updates on their leak site since May 6, it looked like the DoppelPaymer gang was taking a step back, waiting for the public’s attention to ransomware attacks to dissipate.

Fabian Wosar of Emsisoft told BleepingComputer that the two shared the same encrypted file format and used the same distribution channel, the Dridex botnet.
Click to expand...

Malware researchers at cloud security company Zscaler analyzed the early Grief ransomware sample and noticed that the ransom note dropped on infected systems pointed to the DoppelPaymer portal.

“This suggests that the malware author may have still been in the process of developing the Grief ransom portal. Ransomware threat groups often rebrand the name of the malware as a diversion” - Zscaler
The connection between the two extends further, to their leak sites. Although visually they could not be more different, similarities abound, like the captcha code that prevents automated crawling of the site.
Click to expand...

At the moment, there are more than two dozen victims listed on the Grief leak site, showing that the threat actor has been busy working under the new name. It looks like the gang also claims the recent attack on the Greek city Thessaloniki, publishing a file archive as proof of the intrusion.
Click to expand...

ZScaler: DoppelPaymer Continues to Cause Grief Through Rebranding

Conclusion
Grief ransomware is the latest version of DoppelPaymer ransomware with minor code changes and a new cosmetic theme. The threat group has been very active since the release of Grief in the middle of May 2021. However, they have been successful in maintaining a low profile so far.
Click to expand...

guest · Jul 30, 2021

Some ransomware gangs lose interest in extortion sites
July 30, 2021
https://therecord.media/some-ransomware-gangs-lose-interest-in-extortion-sites/

Data released on ransomware extortion sites rose somewhat steadily in 2020 and reached a peak of 521 victims in December of that year. But that number has shrunk almost every month in 2021, and dipped to just 129 victims in June—the lowest number since August 2020.

Allan Liska, a ransomware expert at Recorded Future who has been tracking leak sites operated by ransomware gangs, said these groups are likely realizing that threatening to post stolen data isn’t making them more money.

“Ransomware actors came up with this whole system that they thought would encourage people to pay, and us researchers and journalists lapped it up and said it made perfect sense,” he said. “But we’ve seen over time that companies don’t really suffer consequences if their data winds up on extortion sites. Ransomware actors aren’t always the psychological geniuses we think they are.”
Click to expand...

Another reason extortion sites might be in decline is that they are seen as a liability for the groups. The sites require the groups to publicly expose more of their infrastructure, which could make it easier for law enforcement to shut down their operations.
Click to expand...

guest · Jul 30, 2021

Ransomware attack on Grass Valley
July 27, 2021
https://yubanet.com/regional/ransomware-attack-on-grass-valley/

On June 29, 2021 the City of Grass Valley discovered an unknown source had made unauthorized access to our information systems.

The perpetrators of this cyber attack informed the City they had obtained data from City systems and threatened to publish the data if the City did not pay ransom. The City took immediate actions to protect its systems and data, contacted local and federal law enforcement, and launched an investigation with the assistance of a professional cybersecurity firm.
Click to expand...

This incident had minimal impact on the City’s ability to provide its services, including police, fire, and emergency response. Nearly all City systems remained operational, and any discretionary outages were brief and have now been restored.
[...] the City did choose to pay a ransom to keep the data from being exposed. The amount was covered by insurance. The City is working to identify the potentially compromised data and will give the notice to those whose data was affected as the law requires. This work is ongoing.
Click to expand...

EASTER · Jul 30, 2021

The digital INVASION is in full swing and lining up more vulnerable targets of which that list must be incredibly exhaustive at this point with our massive unchecked population explosion.

hawki · Jul 31, 2021

ronjor said: ↑

DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized
Click to expand...

"DarkSide ransomware gang returns as new BlackMatter operation

Encryption algorithms found in a decryptor show that the notorious DarkSide ransomware gang has rebranded as a new BlackMatter ransomware operation and is actively performing attacks on corporate entities...

In May, the DarkSide ransomware operation suddenly shut down after losing access to their servers and cryptocurrency was seized by an unknown third-party...

This week, a new ransomware operation known as BlackMatter emerged that is actively attacking victims and purchasing network access from other threat actors to launch new attacks..."

https://www.bleepingcomputer.com/ne...re-gang-returns-as-new-blackmatter-operation/

guest · Aug 1, 2021

Illinois AG Raoul Spends $2.5M On Ransomware Hack: Report
July 30, 2021
https://patch.com/illinois/chicago/illinois-ag-raoul-invests-2-5m-after-ransomware-hack-report

Illinois Attorney General Kwame Raoul's office spent more than $2.5 million for cybersecurity after a ransomware hack in April that put the personal data of an unknown number of residents at risk and came after federal authorities told him that his office's cybersecurity systems were lacking.

Raoul declined to acknowledge just how much hackers were demanding in the attack, but told the Better Government Association and Chicago Tribune that he was angered, frustrated and embarrassed by the attack.
Click to expand...

On April 21, several gigabytes of files apparently taken from the attorney general's office were uploaded to a dark web website called Dopple Leaks, which contains "private data of the companies which were hacked by DoppelPaymer," a ransomware gang.
At the time, Raoul said that the cyberattack had compromised his office — and warned Illinois residents to guard themselves against identity theft.
Click to expand...

guest · Aug 1, 2021

Decryptor released for Prometheus ransomware victims
August 1, 2021
https://therecord.media/decryptor-released-for-prometheus-ransomware-victims/

Taiwanese security firm CyCraft has released a free application that can help victims of the Prometheus ransomware recover and decrypt some of their files.

Available on GitHub, the decryptor effectively works by brute-forcing the encryption key used to lock the victim’s data.

“[The] Prometheus ransomware use Salsa20 with a tickcount-based random password to encrypt [files]. The size of the random password is 32 bytes, and every character is a visible character. Since the password use [the] tickcount as the key, we can guess it brutally,” the company’s experts wrote in a blog post at the start of the month.
Click to expand...

Released on July 13, this also marked the last date when the Prometheus gang published any content on its dark web leak site. Two and a half weeks later, the Prometheus gang appears to have ceased operations.

First spotted in February this year, the gang had previously listed more than 40 victims on its leak site. It drew some attention to itself by claiming an association with the more infamous REvil gang, which they removed after the REvil gang’s attack on Kaseya.
In fact, codewise, the two ransomware strains couldn’t have been more different.
Click to expand...

guest · Aug 4, 2021

Ransomware attack hits Italy's Lazio region, affects COVID-19 site
August 3, 2021
https://www.bleepingcomputer.com/ne...ts-italys-lazio-region-affects-covid-19-site/

The Lazio region in Italy has suffered a reported ransomware attack that has disabled the region's IT systems, including the COVID-19 vaccination registration portal.

Early Sunday morning, the Lazio region suffered a ransomware attack that encrypted every file in its data center and disrupted its IT network.

"On the night between Saturday and Sunday the Regione Lazio suffered a first cyber attack of criminal matrix. We don't know who is responsible and their goals," Nicola Zingaretti, the President of the Lazio region, said in a statement on Facebook.
Click to expand...

Possible RansomEXX ransomware attack
Today, sources have told BleepingComputer that the cyber attack on Lazio was conducted by a ransomware operation known as RansomEXX.

In a redacted ransom note shared from the attack on Lazio, the threat actors state, "Hello, Lazio!" and warn the region that their files were encrypted. The ransom note also includes a link to a private dark web page that Lazio can use to negotiate with the ransomware gang.
RansomEXX negotiation pages are unique per victim, and if the threat actors stole data during the attack, the threat actors provide details on the page, including the amount of data stolen and screenshots of files.
Click to expand...

guest · Aug 4, 2021

An interview with BlackMatter: A new ransomware group that’s learning from the mistakes of DarkSide and REvil
August 2, 2021
https://therecord.media/an-intervie...ning-from-the-mistakes-of-darkside-and-revil/

Editor’s Note: In July, a new ransomware gang started posting advertisements on various cybercrime forums announcing that it was seeking to recruit partners and claiming that it combined the features of notorious groups like REvil and DarkSide.

Named BlackMatter, the gang said it was specifically interested in targeting large companies with annual revenues of more than $100 million. However, the group said some industries were off limits: It would not extort healthcare, critical infrastructure, oil and gas, defense, non-profit, and government organizations.
Click to expand...

A representative from the group talked to Recorded Future expert threat intelligence analyst Dmitry Smilyanets recently about how BlackMatter is learning from the mistakes of other ransomware groups, what they look for when they recruit partners, and why they avoid certain targets. The interview was conducted in Russian and translated to English with the help of a professional translator, and has been edited for clarity.
Click to expand...

guest · Aug 5, 2021

Italian energy company ERG hit by LockBit 2.0 ransomware gang
August 5, 2021
https://securityaffairs.co/wordpress/120841/cyber-crime/erg-lockbit-2-0-ransomware.html

Recently the Italian energy company ERG was hit by the LockBit 2.0 ransomware gang, now the company reported “only a few minor disruptions” for its ICT infrastructure. The company is active in the production of wind energy, solar energy, hydroelectric energy and high-yield thermoelectric cogeneration energy with low environmental impact.

“Concerning the recent rumours in the media on hacker attacks on institutions and companies, ERG reports that it has experienced only a few minor disruptions to its ICT infrastructure, which are currently being overcome, also thanks to the prompt deployment of its internal cybersecurity procedures.” reads the notice published by ERG.
ERG added that all its plants are operating smoothly and have not experienced any downtime, thus ensuring continuous business operations
Click to expand...

The ransomware gang has already added the Italian company to the list of victims published on its leak site. The crooks will start leaking the stolen data on August 14, 2021, at 00:00:00.
Click to expand...

guest · Aug 6, 2021

Ransomware attack hits Coghlin Electrical of Worcester
July 30, 2021
https://eu.telegram.com/story/news/...hits-coghlin-electrical-worcester/5403019001/

Coghlin Electrical Contactors, Inc., was hit with a ransomware attack Monday night, but CEO Sue Mailman said all files were recovered without paying hackers.

“We have good backups, we have recovered our files, we did not pay anyone we are working with law enforcement and don’t want to jeopardize our investigation, and we are following all legal requirements,” Mailman said Tuesday in a statement.
She added that employees were able to conduct business Wednesday.
Click to expand...

https://www.databreaches.net/coghlin-electrical-co-hit-with-ransomware-attack/
Update: This incident has been added to Avos Locker’s leak site, with some proof of claims offered. The threat actors write: “Data exfiltration consisted of financial documents, invoices, bank statements, passports scans and IRS tax forms for employees and CEO Susan Marie.”
Click to expand...

guest · Aug 6, 2021

Computer hardware giant GIGABYTE hit by RansomEXX ransomware
August 6, 2021
https://www.bleepingcomputer.com/ne...e-giant-gigabyte-hit-by-ransomexx-ransomware/

Taiwanese motherboard maker has been hit by the RansomEXX ransomware gang, who threaten to publish 112GB of stolen data unless a ransom is paid
Gigabyte is best known for its motherboards but also manufactures other computer components and hardware, such as graphics cards, data center servers, laptops, and monitors.

The attack occurred late Tuesday night into Wednesday and forced the company to shut down its systems in Taiwan. The incident also affected multiple websites of the company, including its support site and portions of the Taiwanese website
Click to expand...

According to the Chinese news site United Daily News, Gigabyte confirmed they suffered a cyberattack that affected a small number of servers.
Gigabyte suffers RansomEXX ransomware attack
While Gigabyte has not officially stated what ransomware operation performed the attack, BleepingComputer has learned it was conducted by the RansomEXX gang.

Today, a source sent BleepingComputer a link to a non-public RansomEXX leak page for Gigabytes Technologies, where the threat actors claim to have stolen 112GB of data during the attack.
In a ransom note also seen by BleepingComputer, the threat actors state, "Hello, Gigabyte (gigabyte.com)!" and include the same link to the private leak page shared with us by our source.
Click to expand...

guest · Aug 8, 2021

Australian cybersecurity agency warns of spike in LockBit ransomware attacks
August 6, 2021
https://therecord.media/australian-...warns-of-spike-in-lockbit-ransomware-attacks/

Australia’s cybersecurity agency has issued a security advisory on Friday warning about a sudden spike in LockBit ransomware attacks across the country.

The Australian Cyber Security Centre (ACSC) said that while the LockBit ransomware gang has attacked Australian companies since 2020, the agency has seen “a sharp and significant increase in domestic victims in comparison to other tracked ransomware variants” since July 2021.

“The ACSC has observed LockBit affiliates successfully deploying ransomware on corporate systems in a variety of sectors including professional services, construction, manufacturing, retail and food,” the agency said today.
While the LockBit gang has been operating since September 2019 with a modicum of success, they launched a new version of their RaaS platform in June 2021.
Click to expand...

The ACSC is now warning Australian companies to take note of this rise in LockBit affiliate activity and prepare for attacks. The agency particularly warns companies to patch their Fortinet networking devices for CVE-2018-13379, a vulnerability that has been identified as the entry point for many LockBit 2.0 attacks.

Furthermore, the agency also warns companies that once their files are encrypted, if they choose not to pay the threat actor and recover from backups, the LockBit gang is one of the ransomware cartels that operates a site on the dark web where they leak data from companies that refused to pay, so victims should be prepared to deal with a public data leak once they got hit.
Click to expand...

ACSC: LockBit 2.0 ransomware incidents in Australia

Background /What has happened?
The ACSC has received reporting from a number of Australian organisations that have been impacted by LockBit 2.0 ransomware. This activity has occurred across multiple industry sectors. Victims have received demands for ransom payments. In addition to the encryption of data, victims have received threats that data stolen during the incidents will be published.
How do I stay secure?
The ACSC has published information on the risks, impacts and preventative actions associated with ransomware on our website.
Click to expand...

guest · Aug 6, 2021

RansomEXX ransomware leaks files stolen from Italian luxury brand Zegna
August 6, 2021
https://securityaffairs.co/wordpress/120898/data-breach/ransomexx-ransomware-zegna.html

Ermenegildo Zegna Group is the largest menswear brand in the world by revenue. As of 2018, Ermenegildo Zegna operated 480 retail stores (267 of which company-owned) across the world. Following the company’s strongly export-oriented strategy, exports account for over 90% of total sales.
The revenge of the company was €1.159 billion as 2018.

The RansomEXX ransomware group claims to have stolen 20.74GB of data from the company and leaked 43 archives (42 archives of 500MB in size and 1 archive containing 239.54MB of documents).
Click to expand...

The RansomEXX gang has been active since 2018 under the name Defray, in June 2020 the group rebranded as RansomEXX. The RansomEXX ransomware targets both Windows systems and virtual machines running VMware ESXi servers.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

EASTER Registered Member

guest Guest

guest Guest

guest Guest

EASTER Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

itman Registered Member

EASTER Registered Member

guest Guest

guest Guest

guest Guest

EASTER Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches