Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Aug 10, 2021

Crytek confirms Egregor ransomware attack, customer data theft
August 10, 2021
https://www.bleepingcomputer.com/ne...gregor-ransomware-attack-customer-data-theft/

Game developer and publisher Crytek has confirmed that the Egregor ransomware gang breached its network in October 2020, encrypting systems and stealing files containing customers' personal info later leaked on the gang's dark web leak site.

The company acknowledged the attack in breach notification letters sent to impacted individuals earlier this month and shared by one of the victims with BleepingComputer earlier today.

"We want to inform you that Crytek was the victim of a ransomware attack by some unknown cyber-criminals," Crytek said in a letter mailed to one of their customers impacted in the incident.
Crytek confirmed that Egregor operators later leaked documents stolen during the incident on their data leak site.
Click to expand...

Data breach impact downplayed
Crytek added downloading the leaked data would've also taken too long, which would have also likely represented a significant hurdle that stopped people from trying to grab it.

Furthermore, threat actors commonly download files leaked on ransomware data leaks to sell or share with other cybercriminals.
Considering this, Crytek's attempts to downplay the seriousness of the data breach resulting from the October 2020 ransomware attack don't hold water.
Click to expand...

guest · Aug 11, 2021

Accenture says Lockbit ransomware attack caused 'no impact' on operations or clients
The IT giant was listed on Lockbit's leak website and the group said the data came from an "insider."
August 11, 2021
https://www.zdnet.com/article/accen...ck-caused-no-impact-on-operations-or-clients/

Billion-dollar tech services firm Accenture is downplaying an alleged ransomware attack that was announced by the Lockbit ransomware group on Tuesday night.

Accenture was listed on the group's leak site next to a timer set to go off on Wednesday. The ransomware group added a note that said, "These people are beyond privacy and security. I really hope that their services are better than what I saw as an insider. If you're interested in buying some databases reach us."
Click to expand...

In a statement to ZDNet, an Accenture spokesperson downplayed the incident, saying it had little impact on the company's operations. Accenture brought in more than $40 billion in revenue last year and has over 550,000 employees across multiple countries.

"Through our security controls and protocols, we identified irregular activity in one of our environments. We immediately contained the matter and isolated the affected servers. We fully restored our affected systems from back up," the company said.
"There was no impact on Accenture's operations, or on our clients' systems."
Click to expand...

guest · Aug 16, 2021

mood said: ↑

Computer hardware giant GIGABYTE hit by RansomEXX ransomware
August 6, 2021
https://www.bleepingcomputer.com/ne...e-giant-gigabyte-hit-by-ransomexx-ransomware/
Click to expand...

AMD and Intel confidential data leaked online after GIGABYTE ransomware attack
August 16, 2021
https://cybernews.com/news/gigabyte-amd-intel-confidential-data-leaked-online/

We recently discovered that a 7 GB archive of confidential data that purportedly belongs to Taiwanese computer hardware manufacturer GIGABYTE had been leaked on a hacker forum following a recent attack by the ransomEXX ransomware gang.

The archive was initially posted on ransomEXX’s public website, presumably after GIGABYTE refused to pay the ransom demanded by the attackers on August 12.
According to the forum post author, the leaked two-part archive appears to contain a variety of GIGABYTE internal company information as well as Intel and AMD proprietary data, including the source code for the Intel Manageability Commander and numerous confidential documents related to AMD.
Click to expand...

Since the original ransomware attack in early August has netted the gang more than 112 GB of data, this leak appears to be just a small portion of the entire haul nicked from the GIGABYTE servers.

This, as well as an ominous ‘to be continued…’ message left by the ransomware group in the leak description, may indicate that unless GIGABYTE decides to pay the ransom, more similar leaks could be coming soon.
Click to expand...

guest · Aug 16, 2021

Hive ransomware attacks Memorial Health System, steals patient data
August 16, 2021
https://www.bleepingcomputer.com/ne...s-memorial-health-system-steals-patient-data/

In what appears to be an attack from the Hive ransomware gang, computers of the non-profit Memorial Health System have been encrypted, forcing staff to work with paper charts.

The attack occurred early Sunday morning and the IT department detected it once they noticed that parts of the infrastructure no longer responded as expected.
Memorial Health System is a small network of three hospitals (Marietta Memorial Hospital, Selby General Hospital, and Sistersville General Hospital) in Ohio and West Virginia, outpatient service sites, and provider clinics.

On Sunday, after learning more about the attack, the organization issued a press release to notify the community of the incident.
Click to expand...

BleepingComputer has seen evidence that the attackers have stolen databases with information belonging to 200,000 patients, which includes sensitive details, such as social security numbers, names, and dates of birth.
Like most ransomware gangs, Hive has a leak site called HiveLeaks and hosted on the dark web, where they published links to data stolen from almost two dozen victims that did not pay the ransom.
Click to expand...

guest · Aug 17, 2021

mood said: ↑

Ecuador's state-run CNT telco hit by RansomEXX ransomware
July 17, 2021
https://www.bleepingcomputer.com/ne...te-run-cnt-telco-hit-by-ransomexx-ransomware/
Click to expand...

Hacker Leaks Data of Ecuador’s Public Telco Stolen Last Month During a Ransomware Attack
August 16, 2021
https://www.technadu.com/hacker-lea...o-stolen-last-month-ransomware-attack/294960/

A forum user has posted a link to the dataset that was stolen from CNT during a ransomware attack last month.

CNT (Corporación Nacional de Telecomunicaciones) hasn’t acknowledged the data breach yet and continues to ignore it.

The data is now shared for free with a much wider audience than previously, so the implications have now become severe.

Click to expand...

A hacker named ‘Holistic-K1ller has leaked the entire 11.23GB of the data set that was stolen from CNT (Corporación Nacional de Telecomunicaciones) last month from ransomware actors and is now sharing it for free via a Mega link posted on RaidForums. The forum listing confirms that the data is the same, and although the ransomware actors, ‘RansomEXX,’ initially claimed to have stolen 190 GB, they ended up posting 11.23 GB in 23 parts.

However, the RansomEXX posted the first samples of the data on July 21, 2021, when the initial negotiations for the payment of the ransom showed their first signs of a stall and eventually let it all out when it became clear that the firm wouldn’t pay them a dime.
The leaked data includes documents containing sensitive information on CNT employees, names and contact details of clients, confidential documents like contracts with third parties, and even ID or driver’s license scans.
Click to expand...

guest · Aug 17, 2021

Blackbaud – firm that paid off crooks after 2020 ransomware attack – fails to get California privacy law claim dropped
August 17, 2021
https://www.theregister.com/2021/08/17/ccpa_blackbaud/

A judge in South Carolina has struck out a number of claims in a consolidated class-action suit alleging cloud CRM provider Blackbaud didn't do enough to prevent a 2020 ransomware attack, but allegations under California's Consumer Privacy Act (CCPA) will move forward.

Blackbaud, a cloud software provider that sells CRM systems for fundraising and communications to charities and educational institutions, admitted last year that it had paid off a ransomware attacker that hit its servers with file-encrypting software in May.

It said at the time: "The cybercriminal did not access credit card information, bank account information, or social security numbers."
However, in a September 2020 US stock market 8-K filing [PDF], Blackbaud said the ransomware infection had potentially resulted in miscreants making off with banking details.
Click to expand...

The case – which deals with more than 15 lawsuits by 34 plaintiffs across 20 states – was consolidated into a single complaint in April by the Judicial Panel on Multidistrict Litigation.
Click to expand...

guest · Aug 17, 2021

Data breach at Pine Labs exposes 500,000 records
August 17, 2021
https://www.thehindubusinessline.co...bs-exposes-500000-records/article35962296.ece

Around 500,000 records of Pine Labs including confidential client agreements, employee data, financial reports, and other internal documents were allegedly hacked by BlackMatter Ransomware Group according to Cyble Research Labs. Screenshots of the data leaked were shared on Cyble’s website on August 11.

Pine Labs, however, denied the claims.
Click to expand...

BlackMatter Ransomware’s post showed 100GB of data was accessed, of which 500 MB worth of data had been shared as a sample.
The leaked data
The data leaked included service and private agreements, and invoices of Pine Labs with various financial institutions and Indian banks. Names, departments and email ids of several Pine Labs employees, too, were leaked. BusinessLine reviewed parts of the sample data.

“The attack came into the limelight after the BlackMatter ransomware group updated its victim list on its leak website on August 10, 2021. The impact of this attack is significant, as initial investigations indicate that the incident has affected multiple financial institutions using Pine Labs services across India,” Cyble wrote.
Click to expand...

Cyble: BlackMatter Ransomware Attack Impacting Multiple Financial Institutions

In the course of our routine threat hunting exercise, the Cyble Research Lab discovered that Pine Labs, an Indian merchant platform company that provides financing and last-mile retail transaction technology, was impacted by a ransomware attack. Our investigation showcased that the BlackMatter ransomware group is behind the attack on Pine Labs. The group has been garnering considerable media attention because of this attack.
Click to expand...

guest · Aug 21, 2021

Ransomware hits Lojas Renner, Brazil’s largest clothing store chain
August 20, 2021
https://therecord.media/ransomware-hits-lojas-renner-brazils-largest-clothing-store-chain/

Lojas Renner, Brazil’s largest clothing department store chain, said it suffered a ransomware attack that impacted its IT infrastructure and resulted in the unavailability of some of its systems, including its official web store.
The company first disclosed the incident in a filing with the Brazilian stock market on Thursday.

Several Brazilian bloggers and news outlets blew the incident out of proportion by claiming that the attack had forced the company to shut down all its physical stores across the country.
Click to expand...

Earlier today, Renner officials filed a second document in order to dispel these rumors and assure shareholders that all stores remained open and that the attack only impacted its e-commerce division.
Suspected RansomExx attack
Details about the ransomware incident remain to be confirmed, but one Brazilian blog claimed that the attack on Renner’s infrastructure was carried out by the RansomExx gang, which gained access to Renner servers via Tivit, a major Brazilian IT and digital services provider.

Attack ransomware ? @Lojas_Renner @felipepayao @LabDefCon1 pic.twitter.com/4LtiYxFUR6
— Clandestine (@akaclandestine) August 19, 2021
However, it is unclear if the intruders managed to steal data from the hacked servers, which would most likely store information related to the company’s e-commerce stores.
Today, the RansomExx gang is one of the many ransomware operations known for running a “leak site” on the dark web, where they publish data stolen from companies that refuse to pay its ransom demand.
Click to expand...

Unconfirmed report claims Renner paid
But just as The Record was preparing to publish this article, an unconfirmed report, citing “unofficial sources,” claimed that Renner paid the hackers $20 million. At the time of writing, this remains to be confirmed, as a Renner spokesperson did not return a request for comment.

Either way, Lojas Renner would be able in a position to pay such a huge ransom demand without breaking a sweat.
Click to expand...

guest · Aug 23, 2021

Nokia subsidiary discloses data breach after Conti ransomware attack
August 23, 2021
https://www.bleepingcomputer.com/ne...es-data-breach-after-conti-ransomware-attack/

SAC Wireless, a US-based Nokia subsidiary, has disclosed a data breach following a ransomware attack where Conti operators were able to successfully breach its network, steal data, and encrypt systems.

The wholly-owned and independently-operating Nokia company, headquartered in Chicago, IL, works with telecom carriers, major tower owners, and original equipment manufacturers (OEMs) across the US.
Click to expand...

Attack detected after Conti ransomware encrypted systems
The company discovered that its network was breached by Conti ransomware operators on June 16, only after deploying their payloads and encrypting SAC Wireless systems.

"The threat actor, Conti, gained access to the SAC systems, uploaded files to its cloud storage, and then, on June 16, deployed ransomware to encrypt the files on SAC systems," SAC says in data breach notification letters sent to an undisclosed number of impacted individuals.
Click to expand...

Conti claims to have stolen 250GB of files
While the company refused to acknowledge the ransomware attack and did not provide more info on the extent of the damage, the Conti ransomware gang revealed on their leak site that they stole over 250 GB of data.

According to a recent update, the ransomware group will soon leak all the stolen files online if the Nokia subsidiary doesn't pay the ransom they demanded.
Click to expand...

guest · Aug 24, 2021

Ransomware gang's script shows exactly the files they're after
August 24, 2021
https://www.bleepingcomputer.com/ne...-script-shows-exactly-the-files-theyre-after/

A PowerShell script used by the Pysa ransomware operation gives us a sneak peek at the types of data they attempt to steal during a cyberattack.

Once they gain access to a Windows domain controller, they search for and steal data on the network before encrypting devices.

The threat actors use this stolen data in two ways.
The first is to generate a ransom demand based on company revenue and whether they have insurance policies. The second is to scare the victims into paying a ransom because the gang will leak the data.
Click to expand...

Searching for valuable data
Yesterday, MalwareHunterTeam shared a PowerShell script with BleepingComputer used by the Pysa ransomware operation to search for and exfiltrate data from a server.

As we would expect, the script seeks out files related to the companies financials or personal information, such as audit, banking information, login credentials, tax forms, student information, social security numbers, and SEC filings.
The full list of 123 keywords targeted by the threat actors' script is listed in the table below.
Click to expand...

However, knowing what types of data a ransom gang is searching for gives you a better indication of how ransomware gangs will attempt to extort their victims.
Click to expand...

guest · Aug 25, 2021

The LockBit 2.0 ransomware attack against Accenture – time is running out
August 25, 2021
https://cybernews.com/security/the-...attack-against-accenture-time-is-running-out/

The company reported revenues of $44.33 billion in 2020 and had 569,000 employees across 50 countries.

LockBit 2.0 ransomware operators initially announced the data breach on their leak site but did not share any files as proof of the attack.
Click to expand...

The countdown displayed on the leak site immediately after the disclosure of the attack was set up for August 11, 2021 (at 5:30 PM) and the group threatened to publish files allegedly stolen from the company.
Immediately after the countdown had expired, the ransomware gang published a small set of stolen data composed of 2,384 items. The leaked files include PDF documents allegedly stolen from the company that appeared as general marketing material.

Later, the ransomware operators removed the above files and postponed the countdown to August 18, 2021 (at 11:43).
Click to expand...

Concluding, it is easy to predict a spike in LockBit 2.0 infections in the next few weeks. When it comes to the attack on Accenture, time is running out, we can only sit and wait for other data leaks.
Click to expand...

guest · Aug 25, 2021

Diving Deeper Into the “Hive” Ransomware Modus Operandi
August 24, 2021
https://www.technadu.com/diving-deeper-hive-ransomware-modus-operandi/296528/

“Hive” is a new ransomware group that uses a strain written in Go, featuring very fast encryption.

The payload accepts commands from a remote actor who operates it manually.

The actors don’t care about who their victims are and simply distribute infection emails everywhere.

Click to expand...

“Hive” is one of the most active ransomware groups right now and the actor who is believed to be responsible for the recent attack against dozens of ‘Memorial Health System’ hospitals in the United States.
Researchers of the Sentinel Labs have analyzed the group from the aspect of its toolset, ethics, encryption power, and victimization methods, and their report contains juicy details on how the actor moves in the wild. This is valuable because Hive was launched roughly a month ago, so it is a new group that hasn’t seen much light shed onto it yet.

First of all, and as the recent attacks against American hospitals underlined, “Hive” doesn’t have any constraints to prevent it from targeting any facility, even those struggling to keep people in need of emergency treatment alive.
Click to expand...

Apart from that, Hive follows a typical approach of operations, including data exfiltration prior to encryption, double extortions, deployment of Cobalt Strike, and the utilization of open source tools for network reconnaissance and credential theft. The ransomware payload itself is a 2MB executable written in Go and packed with UPX.

Dealing with Hive is the same case as dealing with any modern ransomware threat today, so it involves having a solid backup strategy, restricting and monitoring remote access, and using MFA everywhere. Additionally, because the above can’t prevent the double-extortion tactics that typically follow a data breach incident, companies can successfully tackle the ransomware threat only if they stop it at the door – and this can only happen by using state of the art endpoint protection technologies.
Click to expand...

guest · Aug 26, 2021

Personal Data and docs of Swiss town Rolle available on the dark web
August 26, 2021
https://securityaffairs.co/wordpress/121470/cyber-crime/swiss-town-rolle-ransomware.html

The Swiss town Rolle disclosed the data breach after a ransomware attack, personal details of all its 6,200 inhabitants were stolen by threat actors.
The threat actors compromised some administrative servers and exfiltrated sensitive documents.

The attack was orchestrated by the Vice Society ransomware group which hit Lake Geneva.

“Gigabytes of data stolen from Rolle’s vaudois community and posted on darknet. But the city administration presumably knew nothing.” reported the website Remonews. “The community of Rolle VD, idyllically located on Lake Geneva, was hit by a massive data leak. The criminals have posted internal and confidential documents on Darknet, as research by Watson shows.”
Click to expand...

At the time of this writing it is not clear which kinds of information that had been exfiltrated by the attackers, local media reported that compromised data included names, addresses, dates of birth, social security numbers and residency permit information for non-Swiss nationals.

This group focuses on public school districts and other educational institutions, like other ransomware gangs it implements a double extortion model and publishes data stolen from the victims on a data leak site.
Click to expand...

guest · Aug 26, 2021

Ragnarok ransomware releases master decryptor after shutdown
August 26, 2021
https://www.bleepingcomputer.com/ne...are-releases-master-decryptor-after-shutdown/

Ragnarok ransomware gang appears to have called it quits and released the master key that can decrypt files locked with their malware.

The threat actor did not leave a note explaining the move and all of a sudden replaced all the victims on their leak site with a short instruction on how to decrypt files.
Rushed exit
The leak site has been stripped of visual elements and all that is left on the site is the brief text linking to an archive containing the master key and the accompanying binaries for using it.
Click to expand...

Up until earlier today, the Ragnarok ransomware leak site showed 12 victims, added between July 7 and August 16, threat intelligence provider HackNotice told BleepingComputer.
By listing victims on their website, Ragnarok sought to force them into paying the ransom, under the threat of leaking unencrypted files stolen during the intrusion.

Ransomware expert Michael Gillespie told BleepingComputer that the Ragnarok decryptor released today contains the master decryption key.

“[The decryptor] was able to decrypt the blob from a random .thor file,” Gillespie told BleepingComputer initially.
Click to expand...

A universal decryptor for Ragnarok ransomware is currently in the works and will soon be released by Emsisoft, a company famed for assisting ransomware victims with data decryption.
Click to expand...

guest · Sep 20, 2021

US farmer cooperative hit by $5.9M BlackMatter ransomware attack
September 20, 2021
https://www.bleepingcomputer.com/ne...ive-hit-by-59m-blackmatter-ransomware-attack/

U.S. farmers cooperative NEW Cooperative has suffered a BlackMatter ransomware attack demanding $5.9 million not to leak stolen data and provide a decryptor.
NEW Cooperative is a farmer's feed and grain cooperative with over sixty locations throughout Iowa.

In a weekend ransomware attack, the threat actors demand a 5.9 million dollar ransom, which will increase to $11.8 million if a ransom is not paid in five days.
These ransom demands are a starting point for negotiations and usually lead to significantly smaller payments if a victim decides to pay.
Click to expand...

NEW Cooperative has confirmed the attack to BleepingComputer and stated that they had taken their systems offline to contain the attack's spread.

“NEW Cooperative recently identified a cybersecurity incident that is impacting some of our company’s devices and systems. Out of an abundance of caution, we have proactively taken our systems offline to contain the threat, and we can confirm it has been successfully contained," a NEW Cooperative spokesperson told BleepingComputer.
Threat actors claim to steal 1,000 GB of data
On the non-public data leak page, the threat actors claim to have stolen the source code for the soilmap.com project, R&D results, sensitive employee information, financial documents, and an exported database for the KeePass password manager.
Click to expand...

guest · Sep 21, 2021

Marketron marketing services hit by Blackmatter ransomware
September 21, 2021
https://www.bleepingcomputer.com/ne...eting-services-hit-by-blackmatter-ransomware/

BlackMatter ransomware gang over the weekend hit Marketron, a business software solutions provider that serves more than 6,000 customers in the media industry.

Marketron provides cloud-based revenue and traffic management tools for broadcast and media organizations. It specializes in revenue management and audience engagement, handling advertising revenue of $5 billion every year.
Click to expand...

In talks with BlackMatter ransomware
Marketron customers learned of the incident in an email on Sunday night from the company CEO, Jim Howard, who said that “the Russian criminal organization BlackMatter” was responsible for the attack.
This would be the second ransomware attack over the past weekend claimed by the BlackMatter, as the gang also breached the NEW Cooperative U.S. farmers organization, and demanded a $5.9 million ransom.

Bo Bandy, Marketron’s VP of Marketing, disclosed the issues publicly on Monday saying that third-party forensic investigators were working “to understand the full nature and scope of the event, determine root cause, and to ensure the integrity, safety, and security of our systems and data.”
Click to expand...

guest · Sep 21, 2021

Cring Ransomware Gang Exploits 11-Year-Old ColdFusion Bug
September 21, 2021
https://thehackernews.com/2021/09/cring-ransomware-gang-exploits-11-year.html

Unidentified threat actors breached a server running an unpatched, 11-year-old version of Adobe's ColdFusion 9 software in minutes to remotely take over control and deploy file-encrypting Cring ransomware on the target's network 79 hours after the hack.

"Devices running vulnerable, outdated software are low-hanging-fruit for cyberattackers looking for an easy way into a target," Sophos principal researcher Andrew Brandt said. "The surprising thing is that this server was in active daily use. Often the most vulnerable devices are inactive or ghost machines, either forgotten about or overlooked when it comes to patching and upgrades."
The British security software firm said the "rapid break-in" was made possible by exploiting an 11-year-old installation of Adobe ColdFusion 9 running on Windows Server 2008, both of which have reached end-of-life.
Click to expand...

Specially, the adversary took advantage of CVE-2010-2861, a set of directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier that could be abused by remote attackers to read arbitrary files, such as those containing administrator password hashes ("password.properties").

In the next stage, the bad actor is believed to have exploited another vulnerability in ColdFusion, CVE-2009-3960, to upload a malicious Cascading Stylesheet (CSS) file to the server, consequently using it to load a Cobalt Strike Beacon executable.
Click to expand...

Sophos: Cring ransomware group exploits ancient ColdFusion server

Finally, at about 79 hours after the initial breach of the ColdFusion server, the attacker delivered a ransomware executable named msp.exe ran, encrypting the system and the folders containing the virtual machine disk images. The attackers deleted the Volume Shadow Copies, cleared the Event Logs afterward, re-enabled the Sophos security products they had previously disabled.

The ransom note appears on the Windows login screen, as a “message of the day” rather than just as a text file on the desktop.
Click to expand...

Cring Ransomware Exploits 11-Year-Old Adobe ColdFusion Software To Launch Advanced Attack, Sophos Research Reveals

The attackers posted a ransom note that says they also exfiltrated data that is "ready to leak in case we can not make a good deal."
Click to expand...

guest · Sep 24, 2021

mood said: ↑

US farmer cooperative hit by $5.9M BlackMatter ransomware attack
September 20, 2021
https://www.bleepingcomputer.com/ne...ive-hit-by-59m-blackmatter-ransomware-attack/
Click to expand...

Exposed ransomware negotiations shed light on cybercrime, but complicate things for victims
September 24, 2021
https://www.cyberscoop.com/blackmatter-trolls-new-cooperative-ransomware/

Less than 48 hours before the deadline for Iowa-based grain cooperative New Cooperative to pay the BlackMatter ransomware group’s demands, negotiations seemed to take an interesting turn.

The victim shot back with a surprising barb.

#ransomware negotiations on fire pic.twitter.com/4Jhr72oQz7
— (@ddd1ms) September 22, 2021
Except, there was a problem: The “victim” wasn’t actually New Cooperative. It was a random troll.
Click to expand...

The incident raises questions about the potential drawbacks of highly sensitive ransomware negotiations entering the public spotlight. Once public, chats that can provide a goldmine of intelligence for researchers and law enforcement can also become a stomping ground for trolls.
And while New Cooperative was able to regain control of its chat, it may not have been so lucky.

“It’s a possibility that maybe the threat actor won’t catch on as easily and they’ll just sever communication altogether,” said Drew Schmitt, principal threat intelligence analyst at GuidePoint Security.

Recorded Future’s Smilyanets agrees that the hijacking of negotiations can add complications for victims. However, he argued that there is value in adding transparency to the process.

“Every medal has two sides. I see value in transparent and unaltered reporting that disrupts threat actor’s activities,” Smilyanets wrote in an email.
Click to expand...

guest · Sep 28, 2021

Colossus Ransomware Hits Automotive Company in the U.S.
September 28, 2021
https://www.securityweek.com/colossus-ransomware-hits-automotive-company-us

Targeting Windows systems, the Colossus ransomware was used in an attack on an automotive group of dealerships based in the U.S., with its operators threatening to leak 200 GB of stolen data.
The cybercriminals, who were demanding $400,000 to be paid in exchange for the decryption key, have directed the victim to contact them via a “support page” on a custom domain.

ZeroFox’ security researchers note that the Colossus operators appear to be familiar with existing ransomware-as-a-service (RaaS) groups and might even be directly associated with one of them.
Click to expand...

While a public Colossus-specific ransomware leak site doesn’t exist yet, one might emerge in the coming weeks, to leak data from a victim unwilling to pay the ransom.
Click to expand...

ZeroFox: Flash Report: Colossus Ransomware

On Friday, September 24, 2021, the ZeroFox Threat Intelligence team discovered a variant of ransomware called Colossus that affects machines running Microsoft Windows operating systems. The sample has a number of features including binary packing via Themida and sandbox evasion capabilities. The ransomware has a support website for setting up communications with victims, which most likely was launched on September 20, 2021.

As part of routine monitoring, ZeroFox detected and extracted a ransom note [...] The note contained a link with the domain colossus[.]support and a victim key to access a private “Support Room” page to engage the attacker. The page notes a U.S.-based automotive group of dealerships as the target and threatens to dump 200 GB of exfiltrated data if an amount of USD 400,000 is not paid. A countdown timer shows the ransom is scheduled to increase to USD 600,000 in about 3 days.
Click to expand...

guest · Sep 29, 2021

Conti Ransomware Expands Ability to Blow Up Backups
...especially the Veeam recovery software
September 29, 2021
https://threatpost.com/conti-ransomware-backups/175114/

Good at identifying and obliterating backups? Speak Russian? The notorious Conti ransomware group may find you a fine hiring prospect.

That’s according to a report published on Wednesday by cyber-risk prevention firm Advanced Intelligence, which details how Conti has honed its backup destruction to a fine art – all the better to find, crush and kill backed-up data. After all, backups are a major obstacle to encouraging ransomware payment.
Palo Alto Networks has described the gang as a standout, and not in a good way:

“It’s one of the most ruthless of the dozens of ransomware gangs that we follow,” the firm said.
Click to expand...

An example: In May, Ireland’s department of health services was still reeling a week after a Conti ransomware attack that wasn’t even all that successful.
Its expertise in demolishing backups has helped Conti to rain down destruction.

The two-slap whammy of double extortion entails both data encryption and the threat to publish that seized data, but according to AdvIntel’s collection of Conti ransomware samples, Conti views victims’ desire to avoid the publishing of their data as only a secondary goal – most particularly if those victims can rely on backups instead of having to pay.

“If the victim has the ability to restore the files via backups, the chances of successful ransom payment to Conti will be minimized, even despite the fact that the risk of data publishing persists,” the researchers wrote.
Click to expand...

The attackers typically use a weaponized Rclone – a command line program used to manage files on cloud storage – for data exfiltration of the Veeam backups. Finally, to ensure that the victim has been kneecapped and won’t be able to recover, the Conti attackers lock the victim’s system and manually remove the Veeam backups.

AdvIntel outlined the backup removal steps in the chart below:
Click to expand...

Advanced Intelligence: Backup “Removal” Solutions - From Conti Ransomware With Love

Key Takeaways

Backups are a major obstacle for any ransomware operation as they allow the victim to resume business by performing data recovery instead of paying ransom to the criminals.

Cyber groups specifically target backup solutions in order to ensure that the victim has no other option except for paying the ransom. Conti group is particularly methodical in developing and implementing backup removal techniques.

Conti’s tactics are based on utilizing the skills of their network intruders or “pentesters” in order to ensure to target on-premise and cloud backup solutions. Conti hunts for Veeam privileged users and services and leverages to access, exfiltrate, remove and encrypt backups to ensure ransomware breaches are un-”backupable”. This way, Conti simultaneously exfiltrated the data for further victim blackmailing, while leaving the victim with no chances to quickly recover their files as the backups are removed.

Maintaining developed protocols of access rights hierarchy, network security, and password hygiene, as well as systemic network monitoring aimed at spotting abnormal network behavior may significantly reduce the chances of Conti successfully removing backups. Secure backup solutions and mitigations listed will enable any possible victims to leave Conti without their demanded ransom money.

Click to expand...

guest · Sep 29, 2021

mood said: ↑

Trucking giant Forward Air hit by new Hades ransomware gang
December 21, 2020
https://www.bleepingcomputer.com/ne...forward-air-hit-by-new-hades-ransomware-gang/

Hades ransomware – a cryptovirus that asks to contact attackers via TOX instant messaging service
Click to expand...

Trucking giant Forward Air reports ransomware data breach
September 29, 2021
https://www.bleepingcomputer.com/ne...t-forward-air-reports-ransomware-data-breach/

Trucking giant Forward Air has disclosed a data breach after a ransomware attack that allowed threat actors to access employees' personal information.

An SEC filing by Forward Air states that the company lost $7.5 million of less than load (LTL) freight revenue "primarily because of the Company’s need to temporarily suspend its electronic data interfaces with its customers."
Researchers later revealed that this attack was likely conducted by members of the Evil Corp cybercrime gang, who routinely perform attacks under different ransomware names, such as Hades, to evade US sanctions.
Click to expand...

As part of the attack, the threat actors created a Twitter account that they claimed would be used to leak data stolen from Forward Air. However, no data was ever seen leaked by the threat actors.
Forward Air discloses a data breach
Fast forward almost a year, and Forward Air is now disclosing that current and the ransomware attack exposed former employees' data.

"The investigation determined that certain Forward Air systems were accessible in November and early December 2020, and that certain data, which may have included your personal information, was potentially viewed or taken by an unknown actor."
As there is no way to determine if a threat actor has used stolen data, even if they promise not to after a ransom payment, all affected employees should assume that their data has been compromised.
Click to expand...

guest · Sep 30, 2021

Ransomware attack disrupts hundreds of bookstores across France, Belgium, and the Netherlands
September 30, 2021
https://therecord.media/ransomware-...es-across-france-belgium-and-the-netherlands/

Hundreds of bookstores across France, Belgium, and the Netherlands have had their operations disrupted this week after a ransomware attack crippled the IT systems of TiteLive, a French company that operates a SaaS platform for book sales and inventory management.

The incident, which took place earlier this week, has impacted bookstore chains such as Libris, Aquarius, Malperthuis, Donner, Atheneum Boekhandels, and others, according to reports from news outlets in France, Belgium, and the Netherlands.
This resulted in a days-long downtime of MediaLog, the company’s primary product, used by more than 1,000 bookstores, according to TiteLive’s website.
Click to expand...

No ransomware gang has taken credit for the attack so far, with no posts or messages being spotted on the gang’s blogs and leak sites.
Click to expand...

guest · Sep 30, 2021

JVCKenwood hit by Conti ransomware claiming theft of 1.5TB data
September 30, 2021
https://www.bleepingcomputer.com/ne...conti-ransomware-claiming-theft-of-15tb-data/

JVCKenwood has suffered a Conti ransomware attack where the threat actors claim to have stolen 1.7 TB of data and are demanding a $7 million ransom.

JVCKenwood is a multinational electronics company based out of Japan that employs 16,956 people and has a 2021 revenue of $2.45 billion.
Yesterday, JVCKenwood disclosed that servers belonging to its sales companies in Europe were breached on September 22nd, and the threat actors may have accessed data during the attack.

"JVCKENWOOD detected unauthorized access on September 22, 2021 to the servers operated by some of the JVCKENWOOD Group’s sales companies in Europe. It was found that there was a possibility of information leak by the third party who made the unauthorized access," JVCKENWOOD announced in a press statement.
Click to expand...

JVCKenwood hit by ransomware
In a negotiation chat, the ransomware gang claims to have stolen 1.5 TB of files and is demanding $7 million not to publish the data and provide a file decryptor.
As proof that they stole data, the threat actors shared a PDF file indicating it is a scanned passport for a JVCKenwood employee.
Click to expand...

guest · Oct 1, 2021

Conti gang threatens to dump victim data if ransom negotiations leak to reporters
October 1, 2021
https://therecord.media/conti-gang-...ata-if-ransom-negotiations-leak-to-reporters/

The Conti ransomware gang has published a rare public statement today threatening hacked companies that they will leak their stolen files if details or screenshots of the ransom negotiations process are leaked to journalists.

These ransom negotiations usually take place after Conti (or any other ransomware gang) breaches a company and encrypts their files. A ransom note is left on affected desktops, with instructions on how the victim could contact the attackers.
Click to expand...

If an employee of the attacked company uploads a copy of the ransom note or the ransomware binary on malware-scanning portals like VirusTotal, the details included in these ransom notes, including links to the web-based chat feature, can also be discovered by security researchers, who often access these negotiations pages and sometimes share them on social media.

Over the past few years, news outlets specialized in cybersecurity coverage have often worked with security researchers to find links to these secret chats in files uploaded on VirusTotal.
Click to expand...

Conti angered of recent JVCKenwood negotiations leak
Across the years, screenshots from almost all ransomware gangs’ negotiations have leaked on social media or have been shared with reporters.

But in a message posted on its blog today, the Conti gang said that it would not tolerate incidents where screenshots of its negotiations process are leaked online anymore.
As a result, the Conti gang said it is introducing new rules meant to penalize victims or security researchers who leak screenshots of its ransom negotiations chats to reporters:
Click to expand...

guest · Oct 4, 2021

LockBit 2.0 ransomware hit Israeli defense firm E.M.I.T. Aviation Consulting
October 4, 2021
https://securityaffairs.co/wordpress/122892/cyber-crime/e-m-i-t-aviation-consulting-ransomware.html

LockBit 2.0 ransomware operators hit the Israeli aerospace and defense firm E.M.I.T. Aviation Consulting Ltd, threat actors claim to have stolen data from the company and are threatening to leak them on the dark web leak site of the group in case the company will not pay the ransom.

At the time of this writing, the ransomware gang has yet to share any files as proof of the attack, the countdown will end on 07 October 2021.
It is not clear how the threat actors breached the company and when the security breach took place.

Like other ransomware operations, LockBit 2.0 implemented a ransomware-as-a-service model and maintains a network of affiliates.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches