Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest · Oct 4, 2021

AvosLocker ransomware gang to auction the data of victims who don’t pay
October 4, 2021
https://therecord.media/avoslocker-ransomware-gang-to-auction-the-data-of-victims-who-dont-pay/

The operators of the AvosLocker ransomware gang have updated their website to create a system through which they plan to auction off the data of hacked companies that refuse to pay ransom demands.
The AvosLocker gang’s site —updated two weeks ago— introduces a twist on the classic ransomware double-extortion scheme.

First spotted in July 2021, AvosLocker also utilized this well-established scheme and, through the summer, released data from several victims that refused to pay or engage following their attacks.

#Avoslocker has changed up their theme and gone with the dark look. As I'm sure everyone who monitors these sites would agree, the dark them is appreciated.#infosec #ransomware #auspol #cybersecurity #security #cyber #threatintel pic.twitter.com/AJWd9TvkB2
— CyberKnow (@Cyberknow20) September 20, 2021
Click to expand...

However, AvosLocker is not the first gang to add an auction feature to their site, and the update was most likely inspired by the REvil ransomware gang, which was the first to use such a feature back in June 2020.

The good news is that despite the clever feature, the AvosLocker gang is not one of today’s top or most active ransomware groups, with fewer than 10 attacks carried out per week, according to data provided by the ID-Ransomware service.
Click to expand...

guest · Oct 6, 2021

Hong Kong firm becomes latest marketing company hit with REvil ransomware
A security company says global marketing firm Fimmick was attacked by REvil recently.
October 5, 2021
https://www.zdnet.com/article/hong-...-marketing-company-hit-with-revil-ransomware/

Hong Kong marketing firm Fimmick has been hit with a ransomware attack, according to a British cybersecurity firm monitoring the situation.

Fimmick has offices in Hong Kong and across China, serving several high-profile clients like McDonalds, Coca-Cola, Shell, Asus and others.
Their website is currently down and there was no response to ZDNet requests for comment.
Click to expand...

On Tuesday, they discovered that REvil had breached Fimmick's databases and claimed to have data from a number of global brands. Lane shared screenshots showing REvil's threatening posts toward Fimmick that included information stolen from the company's website

"We discovered this intelligence as part of those routine activities. We noted, with interest, that the attacker's 'Happy Blog' also appears to be temporarily unavailable but have no further information as to why that might be," Lane said, adding that the criminal group also shared a directory structure of the stolen data.
"You can see Cetaphil, Coca-Cola, Hana-Musubi and Kate Spade are listed."
Click to expand...

guest · Oct 11, 2021

Pacific City Bank discloses ransomware attack claimed by AvosLocker
October 11, 2021
https://www.bleepingcomputer.com/ne...oses-ransomware-attack-claimed-by-avoslocker/

Pacific City Bank (PCB), one of the largest Korean-American community banking service providers in America, has disclosed a ransomware incident that took place last month.

The bank is circulating notices to inform its clients of a security breach it identified on August 30, 2021, which they claim to have addressed promptly.
The recipients of these notices are advised to remain vigilant against incoming communications and monitor their financial account statements and credit reports for signs of fraud.
Click to expand...

An AvosLocker victim
While Pacific City Bank did not reveal the name of the ransomware group behind the September incident, AvosLocker is claiming the attack and has published an entry on their data leak site

The date of the incident is set on September 4, 2021, so the five days of difference may just be the “grace” period of the initial negotiation round, during which ransomware actors typically avoid making announcements.
AvosLocker is one of the newer ransomware operators, appearing in the wild this summer, calling for affiliates on various underground forums to join the RaaS.
Click to expand...

guest · Oct 12, 2021

Ransomware: No Decline in Victims Posted to Data-Leak Sites
Count of Victims - Listed on Leak Sites or Not - Appears To Be Holding Steady
October 12, 2021
https://www.databreachtoday.com/ransomware-no-decline-in-victims-posted-to-data-leak-sites-a-17719

Not all ransomware-wielding attackers steal victims' data, or threaten to publicly name and shame them, as an inducement to pay a ransom. But one measure of the damage being done by crypto-locking malware does continue to be counting how many victim organizations end up getting listed on ransomware operators' dedicated data-leak sites, as part of so-called double extortion tactics.

Unfortunately, despite the White House declaring war on ransomware, including initiatives to improve the cyber resiliency of U.S. businesses, at least so far the number of victims being listed on such sites hasn't been declining, reports Allan Liska, an intelligence analyst at threat-intelligence firm Recorded Future.

"The number of victims posted to ransomware extortion sites remained near an all-time high in September," Liska tweets. "As always, remember that only a small fraction of ransomware victims make it to extortion sites so these numbers aren't representative of all attacks."
Click to expand...

Victim Count Keeping Constant
Emsisoft says that despite the recent high mark for victim listings, overall the number of organizations getting listed on such sites seems to be holding steady.

"The number of global ransomware incidents has remained relatively stable for quite some time, so it's not surprising that the number of companies appearing on leak sites has remained relatively stable too," says Brett Callow, a threat analyst at Emsisoft

"The gap between the estimated number of incidents and the number of victims that end up on leak sites is simply due to the fact that not all ransomware operators use leak sites - and that includes some of the busier operators, as well as operators such as FIN12."
Click to expand...

The Medium Is The Message
Data-leak sites are yet another tactic created by attackers to pressure victims into paying as soon as possible. Many ransom notes left by attackers on systems they've crypto-locked, for example, will display a countdown timer, and warn a victim that - for example - they only have 48 hours to pay a ransom, or else the ransom demand will double.

If that shakedown step fails to drive a victim to pay, then attackers will often start to leak stolen data, if they managed to obtain any during the attack. By doing so, they send a signal to future victims that if they choose to not pay, they'll suffer a similar fate.
Click to expand...

guest · Oct 13, 2021

Australia to tackle ransomware data breaches by deleting stolen files
October 13, 2021
https://www.bleepingcomputer.com/ne...mware-data-breaches-by-deleting-stolen-files/

Australia's Minister for Home Affairs has announced the "Australian Government's Ransomware Action Plan," which is a set of new measures the country will adopt in an attempt to tackle the rising threat.

Ransomware is a global problem, and Australian businesses aren't excluded from costly service-disrupting attacks. In July, the government warned of an escalation of LockBit activity in the country.
According to a report from the Office of the Australian Information Commissioner (OAIC), in the first half of 2021, data breaches resulting from ransomware attacks grew by 24% compared to H2 2020.
Click to expand...

To address the risk, the Australian government has approved a massive investment of AU $1.67 billion (USD $1.23 billion) over ten years through Australia's Cyber Security Strategy 2020, with the ransomware plan a part of the initiative.

The plan is backed by an investment of AU $164.9 ($121.2 million), with roughly half of it going to the employment of an additional 100 AFP agents. The new task force will undertake the role of identifying, investigating, and targeting cyber criminals.
Click to expand...

Disrupting double-extortion schemes
To further strengthen the ability to conduct investigations and disrupt ransomware attacks, the government is looking to establish new powers through the Surveillance Legislation Amendment Act 2021.

Under this new legislation, the Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC) will have the power to delete or remove data linked to suspected criminal activity, permitting access to devices and networks and even allowing the take over of online accounts for investigation purposes.
Click to expand...

These new powers will allow law enforcement to delete data stolen during ransomware attacks and stored on servers operated by the attackers for use in double-extortion schemes. By deleting the data, law enforcement hopes to prevent potential data breaches if a victim does not pay the ransom.
Click to expand...

guest · Oct 17, 2021

REvil ransomware shuts down again after Tor sites were hijacked
October 17, 2021
https://www.bleepingcomputer.com/ne...uts-down-again-after-tor-sites-were-hijacked/

The REvil ransomware operation has likely shut down once again after an unknown person hijacked their Tor payment portal and data leak blog.

The Tor sites went offline earlier today, with a threat actor affiliated with the REvil operation posting to the XSS hacking forum that someone hijacked the gang's domains.
Click to expand...

The thread was first discovered by Recorded Future's Dmitry Smilyanets, and states that an unknown person hijacked the Tor hidden services (onion domains) with the same private keys as REvil's Tor sites and likely has backups of the sites.

"But since we have today at 17.10 from 12:00 Moscow time, someone brought up the hidden-services of a landing and a blog with the same keys as ours, my fears were confirmed. The third party has backups with onion service keys," a threat actor known as '0_neday' posted to the hacking forum.
The threat actor went on to say that they found no signs of compromise to their servers but will be shutting down the operation.
Click to expand...

The threat actor then told affiliates to contact him for campaign decryption keys via Tox, likely so affiliates could continue extorting their victims and provide a decryptor if a ransom is paid.

With this latest mishap, the operation in its current forum will likely be gone for good.
However, no good thing lasts forever when it comes to ransomware, and we will likely see them rebrand as a new operation shortly.
Click to expand...

guest · Oct 17, 2021

Accenture confirms data breach after August ransomware attack
October 15, 2021
https://www.bleepingcomputer.com/ne...s-data-breach-after-august-ransomware-attack/

Global IT consultancy giant Accenture confirmed that LockBit ransomware operators stole data from its systems during an attack that hit the company's systems in August 2021.

This was revealed in the company's financial report for the fourth quarter and full fiscal year, which ended on August 31, 2021.
The LockBit ransomware gang claimed to have stolen six terabytes of data from Accenture's network and demanded a $50 million ransom.
Click to expand...

Sources familiar with the attack also told BleepingComputer that Accenture confirmed the ransomware attack to at least one cyber threat intelligence vendor.

Even though Accenture has now confirmed that the attackers stole information from its systems and leaked it online, the company has not yet publicly acknowledged the data breach outside SEC filings or filed data breach notification letters with relevant authorities.
Click to expand...

guest · Oct 18, 2021

BlackByte ransomware decryptor released
The "odd" malware avoids systems based on Russian and ex-USSR languages.
October 18, 2021
https://www.zdnet.com/article/blackbyte-ransomware-decryptor-released/

A new form of malware found in a recent IT incident appears to have been inspired by other strains known to reap their operators' huge financial rewards -- but is likely the work of amateurs.

Dubbed BlackByte and discovered by Trustwave, the Windows-based ransomware is considered "odd" due to some of the design and function decisions made by its creators.
In a set of technical advisories published last week (1,2), the cybersecurity firm says the malware only targets systems that are not based on Russian or ex-USSR languages -- a common trend in ransomware believed to be of Russian origin.
Click to expand...

BlackByte has also taken advantage of what has become known as double-extortion in this space: not only does malware encrypt and lock up systems, but victims are also then faced with the threat of confidential information being leaked or sold online.
Modern ransomware operators, including Maze, ReEvil, Conti, and Babuk, run leak websites on the Dark Web for this purpose. BlackByte, too, has launched a website, but according to the researchers, the threat of data exfiltration and leaks is groundless -- as the ransomware does not appear to have this functionality in the first place.

BlackByte's encryption process also reveals that unskilled threat actors may be at work.
Click to expand...

Trustwave has made a BlackByte decryptor available for download at GitHub.
Click to expand...

guest · Oct 21, 2021

Gigabyte Allegedly Hit by AvosLocker Ransomware
October 21, 2021
https://threatpost.com/gigabyte-avoslocker-ransomware-gang/175642/

The AvosLocker ransomware gang is claiming that it breached tech giant Gigabyte, adding that it has leaked a sample of what it claims are files stolen from the Taiwanese company’s network. It’s offering to sell the rest.

On Wednesday, the gang posted a “press release” announcing that it had purportedly gutted the motherboard/server maker, though it didn’t say when or how. The leaked files, seen by PrivacySharks and by Threatpost, appear to contain confidential details regarding deals with third-party companies and identifiable information about employees.
Click to expand...

Below is a screen capture of AvosLocker’s announcement, which refers to a nondisclosure agreement (NDA) between Gigabyte and Barracuda Networks. The NDA, which Threatpost has viewed, is dated June 2007 and signed on behalf of Barracuda by “Drako” – which, if authentic, presumably refers to Barracuda co-founder Dean Drako.

“Gigabyte INC suffered a breach, and this is a sample of the files we’ve downloaded from their network. Barracuda NDA + full dir list leaked in sample,” according to AvosLocker’s statement.
What Was Leaked
In a Thursday post, PrivacySharks said that an independent security researcher affiliated with the company has viewed the contents of a leaked 14.9MB file called “proof.zip” that was purportedly exfiltrated from Gigabyte.
The researcher said that it contains the following list of sensitive information: [...]
Click to expand...

If the leaked files turn out to be legitimate, some are from a fresh breach, with files dating as recently as May.

Earlier this month, the gang reportedly revamped its site to create a way to auction off the data of recalcitrant victims who refuse to pay ransom. It’s not the first ransomware gang to pull this stunt, which is meant to add yet another thumbscrew to the double-extortion gambit of not only freezing victims’ systems but also threatening to publish stolen data if they don’t pay up
Click to expand...

PrivacySharks: Gigabyte Breached by Ransomware Group AvosLocker – Data up for sale

We hope that there are no Gigabyte private master keys included in this leak which could potentially see a new supply chain attack like the Solarwinds Supply Chain Attack. If the leak does include keys, these could be used to impersonate Gigabyte, forcing servers and motherboards to download fake updates and drivers, etc.

Fortunately, our tech experts can only find two .key files and a few .crt files, which may suggest that this breach contains no or very little data from the security/tech departments. However, if Gigabyte revokes any keys in the near future, keep this possibility in mind.
Click to expand...

guest · Oct 24, 2021

Italian celebs' data exposed in ransomware attack on SIAE
SIAE (Italian Society of Authors and Publishers)
October 22, 2021
https://www.bleepingcomputer.com/ne...bs-data-exposed-in-ransomware-attack-on-siae/

The Italian data protection authority Garante per la Protezione dei Dati Personali (GPDP) has announced an investigation into a data breach of the country’s copyright protection agency.

Società Italiana degli Autori ed Editori (SIAE) is a government agency responsible for protecting the intellectual property rights of copyright holders' creative works.
Yesterday, the GPDP announced that they are investigating whether hackers stole the personal data of registered members and employees of SIAE during a ransomware attack.
Click to expand...

Data stolen during a ransomware attack
However, BleepingComputer has found a listing on the extortion portal of the Everest ransomware gang, where the actors claimed to have breached SIAE and have leaked 60 GB of stolen data.

The data leaked by the Everest gang includes national ID and driver's license scans and documents relevant to contract agreements between SIAE and its members.
After not receiving a ransom payment, the threat actors are now selling the data for $500,000.
Click to expand...

guest · Oct 26, 2021

FBI: Ranzy Locker ransomware hit at least 30 US companies this year
October 26, 2021
https://www.bleepingcomputer.com/ne...mware-hit-at-least-30-us-companies-this-year/

The FBI said on Monday that Ranzy Locker ransomware operators had compromised at least 30 US companies this year from various industry sectors.

"Unknown cyber criminals using Ranzy Locker ransomware had compromised more than 30 US businesses as of July 2021," the FBI said in a TLP: WHITE flash alert.
The flash alert was issued in coordination with CISA and is designed to provide information to help security professionals detect and guard against such ransomware attack attempts.

Most Ranzy Locker victims who reported attacks told the FBI that the operators breached their networks by brute-forcing Remote Desktop Protocol (RDP) credentials.
Click to expand...

Ako Ransomware rebrand
Once inside a victim's network, Ranzy Locker operators will also steal unencrypted documents before encrypting systems on their victims' corporate networks, a tactic used by most other ransomware gangs.
When victims visit the group's Tor payment site, they will see a 'Locked by Ranzy Locker' message and a live chat screen to negotiate with the threat actors.

Victims who don't pay the ransoms will have their stolen documents published on Ranzy Locker's data leak site, dubbed Ranzy Leak.
Click to expand...

guest · Oct 27, 2021

An interview with LockBit: The risk of being hacked ourselves is always present
October 26, 2021
https://therecord.media/an-intervie...-of-being-hacked-ourselves-is-always-present/

Editor’s Note: Even though the LockBit ransomware group has been operating since September 2019, up until June this year, they have been a marginal player on the ransomware landscape.

But following the deployment of a new version of their Ransomware-as-a-Service platform, called LockBit 2.0, and the sudden retirement of rival operations Darkside, Avaddon, and REvil, LockBit has become one of today’s largest RaaS platforms.
Click to expand...

Cybercriminal groups who previously rented ransomware payloads from other gangs seems to have flocked to the LockBit group over the summer, leading to a surge in attacks that caused Australian officials to issue a rare warning to local companies. Furthermore, stats collected by Recorded Future have shown that LockBit was, by a large margin, the most active ransomware group last month, in September, amounting for almost a third of all victims listed on ransomware leak sites.

Following similar interviews with the administrators of the REvil and BlackMatter operations, the LockBit group has also agreed to talk to Recorded Future analyst and The Record writer Dmitry Smilyanets. The interview, translated from Russian by one of Recorded Future’s linguists, is available below.
Click to expand...

guest · Oct 27, 2021

Babuk ransomware decryptor released to recover files for free
October 27, 2021
https://www.bleepingcomputer.com/ne...decryptor-released-to-recover-files-for-free/

Czech cybersecurity software firm Avast has created and released a decryption tool to help Babuk ransomware victims recover their files for free.

According to Avast Threat Labs, the Babuk decryptor was created using leaked source code and decryption keys.
The free decryptor can be used by Babuk victims who had their files encrypted using the following extensions: .babuk, .babyk, .doydo.
Click to expand...

Babuk ransomware victims can download the decryption tool from Avast's servers and decrypt entire partitions at once using instructions displayed within the decryptor's user interface.
Ransomware and decryption keys leak
Babuk gang's full ransomware source code was leaked on a Russian-speaking hacking forum last month by a threat actor claiming to be a member of the ransomware group.
Included in the leak were also encryptors and decryptors compiled for specific victims of the ransomware gang.
Babuk's troubled history
Babuk Locker, also known as Babyk and Babuk, is a ransomware operation that launched at the beginning of 2021 when it started targeting businesses to steal and encrypt their data as part of double-extortion attacks. [...]
Click to expand...

Avast: Babuk ransomware decryptor - Download: https://s-decryptors.avcdn.net/decryptors/avast_decryptor_babuk.exe

guest · Oct 27, 2021

Cybercriminals claim to have hacked the NRA
October 27, 2021
https://www.nbcnews.com/tech/security/cybercriminals-claim-hacked-nra-rcna3929

A notorious Russian cybercriminal group has posted what appear to be National Rifle Association files to the dark web.

The group, known as Grief, posted 13 files to its website Wednesday and claimed to have hacked the NRA. It is threatening to release more of the files if not paid, though it did not publicly state how much.
Like many ransomware gangs, Grief often posts a handful files stolen from a victim in an efforts to spur a ransom payment.
Click to expand...

While paying any ransomware hacker is a risk, Grief is particularly tricky. Cybersecurity experts widely believe Grief is a rebranded effort by a group of Russian cybercriminals who previously used the nickname Evil Corp, which is currently under sanctions by the U.S. Treasury Department.

"It's the same group," said Allan Liska, a ransomware analyst at the cybersecurity firm Recorded Future.
Click to expand...

The NRA didn’t immediately respond when reached for comment. Grief, though a criminal group, isn't known for bluffing when it claims an organization was a victim, said Brett Callow, who tracks ransomware groups at the cybersecurity company Emsisoft.

"I’m not aware of any incidents in which Grief/Evil Corp has attempted to take credit for other operations’ attacks," Callow said.

Most of the files viewed by NBC News relate to NRA grants. They include blank grant proposal forms, a list of recent grant recipients, an email to a recent grant winner earlier this month, as well as a W-9 form. The leak also includes the minutes from a Sept. 24 NRA teleconference meeting.
Click to expand...

guest · Oct 29, 2021

ESET found a variant of the Hive ransomware that encrypts Linux and FreeBSD
October 29, 2021
https://securityaffairs.co/wordpress/123931/malware/hive-ransomware-linux-freebsd.html

ESET researchers discovered a new Hive ransomware variant that was specifically developed to encrypt Linux and FreeBSD. Researchers at the cybersecurity firm believe that the new encryptors are still under development.

Both variants are written in Golang, but the strings, package names and function names have been obfuscated.

#ESETresearch has identified Linux and FreeBSD variants of the #Hive #Ransomware. Just like the Windows version, these variants are written in #Golang, but the strings, package names and function names have been obfuscated, likely with gobfuscate. 1/6 pic.twitter.com/dBw0E5pj6r
— ESET research (@ESETresearch) October 29, 2021
Click to expand...

Unlike the Windows variant of the ransomware that supports up to 5 execution options, the new Linux and FreeBSD variants only support one command line parameter (-no-wipe).

According to ESET, Linux version of the Hive ransomware also fails to trigger the encryption if it is not executed with root privileges.

The malware also tries to write the ransom note and key information file to the filesystem root, so unless executed with root privileges, it fails and the encryption is not even triggered. These facts lead us to believe that the Linux variant is still in development phase. 5/6 pic.twitter.com/tuwQKJpFml
— ESET research (@ESETresearch) October 29, 2021
Click to expand...

According to the experts, Hive operators have already hit tens of organizations and the discovery of a Linux variant demonstrates that the gang is expanding its operations.
Click to expand...

guest · Oct 31, 2021

Graff multinational jeweller hit by Conti gang. Data of its rich clients are at risk, including Trump and Beckham
October 31, 2021
https://securityaffairs.co/wordpress/123980/cyber-crime/conti-ransomware-graff-jeweller.html

The latest attack of the Conti ransomware gang makes the headlines, the threat actors hit high society jeweller Graff and asked the payment of a multi-million ransom to avoid leaking details of world leaders, actors and tycoons.

The customers of the company are the richest people on the globe, including Donald Trump, David Beckham,Tom Hanks, Samuel L Jackson, Alec Baldwin, and Sir Philip Green.
As proof of the hack, the group already published on its leak site files related to purchases made by David Beckham, Oprah, and Donald Trump.
Click to expand...

The Conti gang has already leaked 69,000 confidential documents, leaked files include customer lists, invoices, receipts, and credit notes.

The impact on the privacy of the customers could be greater than the value of the purchased jewels, some of the purchases may demonstrate embarrassing relationships between lovers and very important people.
I recommend you to read this post published by the Daily Mail that lists some of the impacted customers and reports some embarrassing purchases.
Click to expand...

At this time thousands of people have already visited the leak site to dig in the published files looking for sensitive info.
Click to expand...

guest · Oct 31, 2021

New Spook Ransomware Building on Prometheus Codes Exposes All Victims, Even Paying Ones
October 30, 2021
https://www.technadu.com/spook-ransomware-prometheus-codes-exposes-all-victims/309801/

Spook is a new ransomware taking corporate data hostage across major US industries, with a focus on manufacturing.

It is based partially on the previously notorious ransomware families Prometheus and Thanos and divulges stolen data no matter if the ransom is payed.

With the capacity to negate anti-ransomware like Raccine, it has claimed 17 victims so far.

Click to expand...

A new ransomware called Spook is emerging as a big threat in the cybersecurity space, and it was first noticed in late September this year. The malware seems to be based on previously known malware like Prometheus, which itself is based on another previous malware called Thanos. To date, according to Spook’s own website tally, it has claimed 17 victims and has been attacking industries without any discernable discretion. The data for which the ransom is not paid is listed as “For Sale” while negotiations happening for others via its TOR payment portal are put under “Company Decides.”

Apparently, Spook and Prometheus share a code similarity between 29 to 50 percent. SentinelLabs researchers have noticed they also have layout and structure similarities, particularly in the payment portal.
Click to expand...

Further, the malware will prevent antivirus or anti-malware software bootups. It also maintains a startup directory shortcut for displaying the ransom note every time a system is rebooted. The first part of the process inhibits Raccine anti-ransomware process popularly used by organizations.
Click to expand...

SentinelLabs: Spook Ransomware | Prometheus Derivative Names Those That Pay, Shames Those That Don’t

Executive Summary

Spook Ransomware is an emerging player first seen in late September 2021

The operators publish details of all victims regardless of whether they pay or not

Targets range across several industries with an emphasis on manufacturing

Analysis shows a significant degree of code sharing between Spook and the Prometheus and Thanos ransomware families

Click to expand...

guest · Nov 2, 2021

BlackMatter Group Speeds Up Data Theft with New Tool
November 1, 2021
https://www.infosecurity-magazine.com/news/blackmatter-speeds-data-theft-tool/

Security researchers have discovered a new data exfiltration tool designed to accelerate information theft for ransomware groups using the BlackMatter variant.

The Symantec Threat Hunter team explained in a new blog post today that the custom tool is the third discovery of its kind, following the development of the Ryuk Stealer tool and the LockBit-linked StealBit.
Dubbed “Exmatter,” it is designed to steal specific file types from selected directories and then upload them to a server under the control of BlackMatter attackers.
Click to expand...

This process of whittling down data sources to only those deemed most profitable or business-critical is designed to speed up the whole exfiltration process, presumably so the threat actors can complete their attack stages before being interrupted.

Once exfiltration has been completed, Exmatter looks to overwrite and delete any traces of itself from the victim’s computer.
Symantec said it found various versions of the tool, indicating that its developers have tried to refine its functionality to accelerate the process of data theft as far as possible.
Click to expand...

The researchers claimed BlackMatter itself is linked to the “Coreid” cybercrime group, which may have also been responsible for Darkside — the variant that led to the Colonial Pipeline outage.

“Like most ransomware actors, attacks linked to Coreid steal victims’ data and the group then threatens to publish it to further pressure victims into paying the ransom demand,” Symantec concluded.
“Whether Exmatter is the creation of Coreid itself or one of its affiliates remains to be seen, but its development suggests that data theft and extortion continues to be a core focus of the group.”
Click to expand...

Symantec: BlackMatter: New Data Exfiltration Tool Used in Attacks

At least one affiliate of the BlackMatter ransomware operation has begun using a custom data exfiltration tool in its attacks. Exmatter, which was discovered by Symantec’s Threat Hunter Team, is designed to steal specific file types from a number of selected directories and upload them to an attacker-controlled server prior to deployment of the ransomware itself on the victim’s network.

This is the third time a custom data exfiltration tool appears to have been developed by ransomware operators, following the earlier discovery of the Ryuk Stealer tool and StealBit, which is linked to the LockBit ransomware operation.
Click to expand...

guest · Nov 2, 2021

FBI: Ransomware targets companies during mergers and acquisitions
November 2, 2021
https://www.bleepingcomputer.com/ne...ts-companies-during-mergers-and-acquisitions/

The Federal Bureau of Investigation (FBI) warns that ransomware gangs are targeting companies involved in "time-sensitive financial events" such as corporate mergers and acquisitions to make it easier to extort their victims.

In a private industry notification published on Monday, the FBI said ransomware operators would use the financial information collected before attacks as leverage to force victims to comply with ransom demands.

"The FBI assesses ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections," the federal law enforcement agency said.
"During the initial reconnaissance phase, cyber criminals identify non-publicly available information, which they threaten to release or use as leverage during the extortion to entice victims to comply with ransom demands," the FBI added.
Click to expand...

Ransomware gangs target victims' stock price
For instance, last year, the REvil (Sodinokibi) ransomware gang said they were considering adding an auto-email script that would reach out to stock exchanges, such as NASDAQ, to let them know that companies were hit by ransomware to impact their stock price.

REvil is also sifting through stolen data after breaching companies' servers to find damaging information that can be used to force their victims into paying the ransoms.
Click to expand...

FBI - Private Industry Notification (PIN): https://www.ic3.gov/Media/News/2021/211101.pdf

Summary
The FBI assesses ransomware actors are very likely using significant financial events, such as mergers and acquisitions, to target and leverage victim companies for ransomware infections.
Prior to an attack, ransomware actors research publicly available information, such as a victim’s stock valuation, as well as material nonpublic information. If victims do not pay a ransom quickly, ransomware actors will threaten to disclose this information publicly, causing potential investor backlash.
Click to expand...

guest · Nov 8, 2021

mood said: ↑

Graff multinational jeweller hit by Conti gang. Data of its rich clients are at risk, including Trump and Beckham
October 31, 2021
https://securityaffairs.co/wordpress/123980/cyber-crime/conti-ransomware-graff-jeweller.html
Click to expand...

Conti ransomware gang apologized to Arab Royals over data leak
November 8, 2021
https://www.hackread.com/conti-ransomware-gang-sorry-arab-royals-data-leak/

In October 2021, the infamous Conti ransomware gang leaked thousands of records stolen from UK-based jewelry store Graff. In a surprising turn of events, the hackers have posted a statement to let the world know that they regret their decision to leak data as it included files of powerful personalities.
What Happened?
Last month, the Conti ransomware gang claimed that it stole data from around 11,000 Graff customers. The gang later leaked 69,000 documents from the jeweler’s data. The theft was reported by The Mail last week.

Now Conti gang has posted a statement apologizing to Arabian Gulf royals, making it clear that they do not intend to sell or trade the data. From now on, they will implement a “rigid data review process for any future operations.”
Click to expand...

Apology Statement
The statement was posted as a press release on Thursday. Conti vowed to delete ‘any information pertaining to members of Saudi Arabia, UAE, and Qatar families” without reviewing or exposure.

“We found that our sample data was not properly reviewed before being uploaded to the blog. Conti guarantees that any information pertaining to members of Saudi Arabia, UAE, and Qatar families will be deleted without any exposure and review.”
The gang further noted that they didn’t want to promote revenge attacks. That’s why they have exposed only 1% of the total haul (69,000 files). None of the stolen data was auctioned or sold and not even offered as samples “or revealed in any other capacity to any third party.”
Click to expand...

guest · Nov 9, 2021

MediaMarkt hit by Hive ransomware, initial $240 million ransom
November 8, 2021
https://www.bleepingcomputer.com/ne...y-hive-ransomware-initial-240-million-ransom/

Electronics retail giant MediaMarkt has suffered a Hive ransomware with an initial ransom demand of $240 million, causing IT systems to shut down and store operations to be disrupted in Netherlands and Germany.

MediaMarkt is Europe's largest consumer electronics retailer, with over 1,000 stores in 13 countries. MediaMarkt employs approximately 53,000 employees and has a total sales of €20.8 billion.
Click to expand...

A Hive ransomware attack
MediaMarkt suffered a ransomware attack late Sunday evening into Monday morning that encrypted servers and workstations and led to the shutdown of IT systems to prevent the attack's spread.

BleepingComputer has learned that the attack affected numerous retail stores throughout Europe, primarily those in the Netherlands.
Local media reports that internal MediaMarkt communications tell employees to avoid encrypted systems and disconnect cash registers from the network.
Click to expand...

Screenshots posted on Twitter of alleged internal communications state that 3,100 servers were affected in this attack. However, BleepingComputer has not been able to corroborate those statements at this time.

#MediaMarkt / #Saturn gerade scheinbar in ganz DE und NL von #Ransomware betroffen.
Alle Kassen still, nichts läuft, sieht nicht gut aus pic.twitter.com/OR4stCaTT6
— Hozan Murad (@HozanMurad) November 8, 2021
BleepingComputer has confirmed that the Hive Ransomware operation is behind the attack and initially demanded a huge, but unrealistic, $240 million ransom demand to receive a decryptor for encrypted files.
Click to expand...

Ransomware gangs commonly demand large ransoms at the beginning to allow room for negotiation and usually receive a fraction of the initial demand. However, in the attack on MediaMarkt, BleepingComputer has been told it was almost automatically reduced to a much lower amount.

While it is not clear if unencrypted data has been stolen as part of the attack, Hive ransomware is known to steal files and publish them on their 'HiveLeaks' data leak site if a ransom is not paid.
Click to expand...

guest · Nov 11, 2021

MediaWorld still blocked for ransomware attack. Open shops, intermittent services
November 11, 2021
https://d1softballnews.com/mediawor...ware-attack-open-shops-intermittent-services/

The MediaMarktSaturn group has suffered a heavy ramsonware attack in recent days. It is difficult to say who did it: someone from Holland is ready to believe that it is the Hive group, which would have asked for 240 million dollars in bitcoin, however at the moment there is no claim on the official “pr” page of the hacker group.

The absence of a claim by the group could also be read as an ongoing negotiation, because it is a real struggle against time to get back up and running as soon as possible. We wrote MediaMarktSaturn and not MediaWorld, because the attack started from the Netherlands, it seems with classic infiltration techniques, and then spread to the central structure.
Click to expand...

MediaWorld Italia issued the following statement: “The IT systems of MediaMarktSaturn Retail Group and its local organizations, including MediaWorld in Italy, were the subject of a targeted action. The company immediately informed the competent authorities and is working tirelessly to identify the systems involved and implement any and all appropriate measures in order to resolve the situation as soon as possible.

In Italy they have disconnected many terminals, to avoid the spread of ransomware, and are thus forced to work blindly, without communication with part of the servers that communicate with the German servers, those of the parent company. MediaWorld goes, shops go but some services go to pieces or are not available.
Source link
Click to expand...

guest · Nov 12, 2021

Ransomware experts question massive Pysa/Mespinoza victim dump
The prolific ransomware group dumped more than 50 victim names onto its leak site this week.
November 12, 2021
https://www.zdnet.com/article/ransomware-experts-question-massive-pysamespinoza-victim-dump/

The Pysa ransomware group dumped dozens of victims onto their leak site this week right after US law enforcement officials announced a range of actions taken against ransomware groups.
More than 50 companies, universities, and organizations had their names added to the ransomware group's leak site.

The group, which also goes by the name Mespinoza, was called out by the FBI in March for specifically targeting "higher education, K-12 schools, and seminaries." The FBI said at least 12 educational institutions across the US and UK had been hit with the ransomware. The French National Agency for the Security of Information Systems issued a similar alert one year earlier.
Click to expand...

Recorded Future ransomware expert Allan Liska told ZDNet he did not think all of the victims published to the site were new.

"We have seen them take six months, and even longer, from when a victim is first hit to when [stolen data] is published," Liska said. "This could be all the victims they have been stalling on publishing data, but it would represent more victims than we have seen from them the rest of the year. It is a lot of different organizations, from around the world, with no theme."
Emsisoft threat analyst Brett Callow told ZDNet that Pysa names and shames its victims weeks, or sometimes months, after the attacks take place, differentiating it from other ransomware groups.

The reason they waited this long to leak victim information is still unclear, he said, adding that it was curious they dumped this many names all at once.
Click to expand...

Both Callow and Liska said the timing of the Pysa's dump was curious considering the actions being taken by law enforcement.

"You can't help but wonder whether their doing so now is in response to the news in relation to REvil -- either a middle finger to law enforcement or, perhaps, an expression of confidence in case any of their affiliates are starting to get cold feet," Callow told ZDNet.
Liska echoed that it felt like Pysa was "giving the finger" to law enforcement after a bad day for ransomware groups.
Click to expand...

guest · Nov 13, 2021

Data of Lister fertility clinic patients compromised in a ransomware attack
November 13, 2021
https://www.teiss.co.uk/fertility-clinic-patients-data-breach/

In a letter sent to about 1,700 patients, Lister Fertility Clinic said that a ransomware attack on Stor-a-file Limited, a firm that scans medical records for the clinic, compromised the sensitive information of patients.

“We were advised by Stor-a-file that the cyber-gang that accessed their systems made a ransom demand which was not paid and that the gang has released some of the data that they accessed on the dark web,” the clinic added. While the cyber-gang who attacked Stor-a-file did say that it won’t release any medical records on the dark web, the clinic told its patients that it can’t be sure about that.
Stor-a-file said the same ransomware attack also affected the Nuffield Health Leicester Hospital.
Click to expand...

guest · Dec 6, 2021

Marine services provider Swire Pacific Offshore hit by ransomware
November 26, 2021

Marine services giant Swire Pacific Offshore (SPO) has suffered a Clop ransomware attack that allowed threat actors to steal company data.

Swire Pacific Offshore discovered an unauthorized network infiltration onto its IT systems, resulting in the compromise of some employee data.

"Swire Pacific Offshore (SPO) has discovered that it was the target of a cyberattack which involved unauthorised access to its IT systems," Swire Pacific Offshore said in a statement to BleepingComputer.
Click to expand...

Clop gang claims responsibility.
The Clop ransomware group has claimed responsibility for the attack and posted screenshots of data during the attack.

The screenshots indicate that the ransomware gang stole passports, payroll information, ID numbers, bank account details, email addresses, and internal correspondence messages.
From what BleepingComputer could discern by the leaked data, the claims that the threat actors stole employees' personal data during the attack appear valid.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches