Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood · Apr 24, 2020

SeaChange video platform allegedly hit by Sodinokibi ransomware
April 23, 2020
https://www.bleepingcomputer.com/ne...tform-allegedly-hit-by-sodinokibi-ransomware/

A leading supplier of video delivery software solutions is reportedly the latest victim of the Sodinokibi Ransomware, who has posted images of data they claim to have stolen from the company during a cyberattack.

SeaChange, a Waltham, Massachusets company with locations in Poland and Brazil, is an on-premise or remotely managed video-on-demand and streaming platform provider. SeaChange's customers include the BBC, Verizon, DISH, COX, DirecTV, and COX.
Since last year, ransomware operators have been launching data leak sites that they use to publish files stolen from victims when performing a ransom attack.
Sodinokibi posts images of SeaChange's data
In an update to their data leak site, Sodinokibi (REvil) has created a new victim page for SeaChange where they have published images of some of the documents that they have stolen during an alleged attack.
Click to expand...

When we asked the Sodinokibi operators how much the ransom was and the amount of data stolen, they refused to provide any further information.

"Thank you for your interest and your questions, but I really can't answer.
We publish confidential information about companies if they ignore us for a long time or decide not to pay. Otherwise, we are not ready to share any information about them in their own interests, including share which companies we have encrypted, how much data we have stolen, etc."
It is common for ransomware operators to slowly release small amounts of stolen data to continue applying pressure on their victims.
Click to expand...

mood · Apr 27, 2020

Hackers publish ExecuPharm internal data after ransomware attack
April 27, 2020
https://techcrunch.com/2020/04/27/execupharm-clop-ransomware/

U.S. pharmaceutical giant ExecuPharm has become the latest victim of data-stealing ransomware.

ExecuPharm said in a letter to the Vermont attorney general’s office that it was hit by a ransomware attack on March 13, and warned that Social Security numbers, financial information, driver licenses, passport numbers and other sensitive data may have been accessed.
But TechCrunch has now learned that the ransomware group behind the attack has published the data stolen from the company’s servers.

The data was posted to a site on the dark web associated with the CLOP ransomware group. The site contains a vast cache of data, including thousands of emails, financial and accounting records, user documents and database backups, stolen from ExecuPharm’s systems.
Click to expand...

When reached, a company executive confirmed to TechCrunch that CLOP was behind the attack.
“ExecuPharm immediately launched an investigation, alerted federal and local law enforcement authorities, retained leading cybersecurity firms to investigate the nature and scope of the incident, and notified all potentially impacted parties,” said ExecuPharm operations chief David Granese.
Click to expand...

mood · Apr 27, 2020

'Smart' parking meter vendor had data stolen in ransomware attack
April 27, 2020
https://statescoop.com/smart-parking-meter-vendor-data-stolen-ransomware-attack/

A company that sells “smart” parking meters and technology used by parking-enforcement agencies in cities around the world was recently the victim of a ransomware attack that also exposed some of its internal files on a website maintained by the hackers responsible.

CivicSmart, a Milwaukee firm that sells parking meters capable of processing mobile payments, hardware and software used in enforcing parking rules and mobile apps used by motorists and government employees alike, was hit last month with a form of ransomware known alternatively as Sodinokibi or REvil.
The attack was noticed in March by the Israeli security firm Under the Breach, but otherwise went undisclosed.

The hackers’ page for CivicStart was later updated to indicate the company had paid up and the stolen files were taken down.

“CivicStart are very pragmatic guys and real businessmen, who managed to admit core mistakes and fix all the vulnerabilities,” it reads. “Be like CivicSmart, try not to get into this blog :).”
Click to expand...

“The problem in cases like this is that the criminals still have the data,” he told StateScoop in an email. “They may claim it will be deleted upon payment, but why would criminals ever delete information they may be able to further monetize?”
Callow said CivicStart’s stolen files could be used to leverage spearphishing attacks against city agencies to infect them with ransomware, or rip them off with business email compromise schemes.

But whether CivicStart has informed any of its government or enterprise customers is unclear. Reached by phone, the company’s chief executive, Mike Nickolaus, said he was “not in a position to confirm or deny” the cyberattack or whether he has informed his clients.
Click to expand...

mood · Apr 28, 2020

Zaha Hadid Architects held to ransom by cyberhacker
April 27, 2020
https://www.architectsjournal.co.uk...eld-to-ransom-by-cyberhacker/10046940.article

ZHA alerted police on Tuesday (21 April) after finding messages left on its server saying internal company data had been encrypted and would only be released if it negotiated a ransom settlement with the hacker.

ZHA declined to communicate with the hacker and has enlisted a cyber-forensics team to investigate the data breach.
While the encryption of some server information is not a serious problem, as the data was backed up, it is unknown how much information has been stolen.

It is understood clients have not yet been made aware of the security breach, as the company could not yet guarantee its communications system was secure.

A spokesperson for ZHA said: ‘With all our 348 London-based staff working from home during this pandemic and cyber criminals poised to exploit the situation, we strongly advise the architectural community to be extremely cautious.
Click to expand...

ZDNet: Hackers threaten to leak data from famous high-end Zaha Hadid architecture firm

A group of hackers has breached the network of Zaha Hadid Architects, one of the world's leading architectural firms, responsible for hundreds of high-end building designs all over the world.

ZDNet learned of the incident from a source last week but was also contacted by the hackers today, who reached out to share a link to the website where they plan to release ZHA data.
The hackers, who said they go by the name of Light (possibly the name of their ransomware variant), provided ZDNet with proof of having ZHA files in their possession.

The Light hacker gang told ZDNet that they intend to publish the data later today if the company does not pay the ransom demand.
Click to expand...

mood · May 1, 2020

Hackers say they stole millions of credit cards from Banco BCR
May 1, 2020
https://www.bleepingcomputer.com/ne...tole-millions-of-credit-cards-from-banco-bcr/

Hackers claim to have gained access to the network of Banco BCR, the state-owned Bank of Costa Rica, and stolen 11 million credit card credentials along with other data.
This attack was allegedly conducted by the operators of the Maze Ransomware, who have been behind numerous cyberattacks against high-profile victims such as IT services giant Cognizant, cyber insurer Chubb, and drug testing facility Hammersmith Medicines Research LTD.

On their data leak site, the hackers claim to have gained access to Banco BCR's network in August 2019, but did not proceed with encrypting the devices as "the possible damage was too high."
As proof of this theft, Maze posted what they say are 240 credit card numbers, with the last four digits removed, along with expiration dates and credit card verification codes (CVC).
Click to expand...

The ransomware operators told BleepingComputer that they have tried to contact the bank multiple times with a ransom demand and may sell the data on the dark web.
Maze states that this ransom is their "reward for pointing out problems in the security system through which half a bank could be pulled out".
Click to expand...

mood · May 2, 2020

North Dakota government fiber provider hit by ransomware
May 1, 2020
https://statescoop.com/north-dakota-government-fiber-provider-hit-maze-ransomware/

The company that operates a fiber optic network that supports statewide and local government entities across North Dakota was a victim of a recent ransomware attack that included some of the firm’s files being published on a website that attempts to shame victims into paying.

Dakota Carrier Network is a consortium of 14 independent broadband companies across the largely rural state that collectively own more than 40,000 miles of fiber and counts among its customers STAGEnet, a network shared by the state government and about 400 other public-sector entities, [...]
But early last Sunday morning, DCN learned its internal systems had been infected with ransomware.

“We quickly shut everything down and restored all of our data from the most recent tape backup, which was Friday, April 24,” he told StateScoop in an email.
Click to expand...

A zip file available on the Maze website contains invoices, payroll information, vendor lists, password-reset requests and customer profiles, though no sensitive personal information like Social Security numbers appears to have been exposed.

“They seem to start by publishing old and less sensitive documents, presumably so as not to lessen the victims’ incentive to pay.”
[...] there was no disruption to its fiber services, which reach about 164,000 customers across the state.
Click to expand...

mood · May 3, 2020

Maze Ransomware
PeroxyChem discloses ransomware attack as it continues to address recovery
Notification from IT Security (May 1, 2020)

On Friday, April 24, PeroxyChem experienced a ransomware attack that partly affected our core corporate infrastructure and a small number of user endpoints. Containment actions have been taken and we are working with law enforcement.
Click to expand...

Full Respnse (PDF): http://peroxychem.com/media/337797/it-security-5120.pdf

We are sending this message to all clients and vendors, regardless of whether we believe your data was compromised or not. We want to apologize for any inconvenience this may cause.

It is clear to us that the attack was focused on our corporate systems and was designed to
impact our business operations. At first glance, a forensics investigation has revealed that a significant amount of our accounts payable data has been stolen.

However, with this data potentially available to the public, we would ask you to be extra vigilant in your accounts payable/receivable, to prevent false invoicing or other fraudulent behavior. Remain mindful and aware and don’t let yourselves be taken in by the scammers.
Click to expand...

The attack was initiated by a group known as Maze. Consistent with the tactics of this group, we believe the attacker compromise happened prior to the ransomware event. We had engaged CrowdStrike, a global leader in cybersecurity, to conduct an investigation when the attack occurred.
Click to expand...

mood · May 6, 2020

Maze Ransomware Operators Step Up Their Game
Investigations show Maze ransomware operators leave "nothing to chance" when putting pressure on victims to pay
May 6, 2020
https://www.darkreading.com/threat-...e-operators-step-up-their-game/d/d-id/1337756

In working with a client, Kroll incident response experts gained access to a discussion with Maze ransomware operators who revealed some of the group's inner workings. This, combined with a new FAQ file Maze published on its "shaming" website, gives analysts the impression that Maze operators "are leaving nothing to chance" when pressuring victim organizations to pay quickly.

Laurie Iacono, vice president with Kroll's Cyber Risk team, started looking into Maze toward the end of 2019 when it launched the shaming website. "As early as January of 2020, they really started focusing on that shaming site, and they were the first ones to put up a shaming site like that," she explains.
"You have so long to pay the ransom or you get on the site," Iacono says. As she continued to check the site in early 2020, she noticed frequent changes to make it more user-friendly.
Click to expand...

In the writeup of their findings, Kroll experts advise businesses to heed Maze's claims and threatened retaliations for refusing to pay when considering incident response strategies. No industry is safe, they say, and Maze looks for data to cause reputational and regulatory harm.
It's tough to defend against Maze because the group uses a lot of the same legitimate tools that businesses use.

If an attack is successful, organizations should be prepared to respond quickly. Wojcieszek advises building their incident response plans with ransomware-specific policies and determine their stance on paying ransom.
Click to expand...

Kroll: A Deep Dive Into the Latest Maze Ransomware TTPs

mood · May 7, 2020

MAZE Claims Ransomware Attack on US Egg Supplier
May 7, 2020
https://www.infosecurity-magazine.com/news/maze-claims-ransomware-attack-on-us/

The threat group MAZE has published what it claims is data stolen from a Minnesota egg supplier during a ransomware attack.

According to MAZE, egg producer and supplier Sparboe was cracked into on May 1, 2020. As proof of the attack, the threat group has shared a zip file of data it claims was exfiltrated from Sparboe's systems.
The zip file contains 17 folders of what appears to be information on current and former employees, nest-run inventory, expense report, injury reports, dock schedules, and other data.

"It’s impossible to say exactly what data may have been obtained in these incidents," commented Emsisoft's Brett Callow. "The initial data dump is typically simply a warning shot—or the equivalent of a kidnapper sending a pinky finger."
Click to expand...

Sparboe Companies did not confirm or deny the alleged ransomware attack by MAZE and is yet to respond to a request for comment.
Click to expand...

mood · May 8, 2020

REvil ransomware threatens to leak A-list celebrities' legal docs
May 8, 2020
https://www.bleepingcomputer.com/ne...eatens-to-leak-a-list-celebrities-legal-docs/

The Sodinokibi ransomware group threatens to release hundreds of gigabytes of legal documents from a prominent entertainment and law firm that counts dozens of international stars as their clients.

Grubman Shire Meiselas & Sacks (GSMLaw) is based in New York and represents dozens of heavyweight artists. Looking at its list of clients, you can spot names that are known all over the world: Madonna, Lady Gaga, Elton John, Robert de Niro, Nicki Minaj, Chris Brown, Usher, U2, Timbaland, Rick Ross, and many others.
Big names all over
The company, self described as “universally recognized as one of the premier entertainment and media law firms in the country,” specializes in all areas of entertainment and media.

Sodinokibi, also referred to as Sodin or REvil by some publications, allegedly hacked GSMLaw. To support their claim, the hackers published a screenshot of the folders they have.
The hackers say that the type of data they have includes contracts, phone numbers, email addresses, personal correspondence, non-disclosure agreements. However, the trove is not limited to these and supposedly is 756GB large.
Click to expand...

mood · May 8, 2020

Beyonce and Victoria's Secret lingerie maker targeted by extortionists
May 5, 2020
https://news.sky.com/story/beyonce-...erie-maker-targeted-by-extortionists-11983025

The criminal group is demanding a ransom from MAS Holdings after stealing what it claims is 300 GB of private files and posting some allegedly stolen documents online as evidence.
Among the documentation published by the criminals as proof was an index list of files it claimed belonged to MAS Holdings, notably including audit documents featuring worker payroll summaries.

The attempted extortion comes from a group known as Nefilim, which first posted what it claimed was stolen data from MAS Holdings online a number of weeks ago.
Although this data was subsequently taken down, it has now been re-uploaded alongside more data it claims is from the company's network.
Click to expand...

The extortion attempt was flagged to Sky News by Brett Callow, a senior researcher at cyber security firm Emsisoft, who specialises in tracking these ransomware groups.

"A company in this situation has no good options available to it," explained Mr Callow.
"The data may be misused or monetised whether the company pays or not. Speedy disclosure is absolutely critical in these cases given the risk they present to the both individuals and other companies."
Click to expand...

mood · May 12, 2020

Maze ransomware one year on – a SophosLabs report
May 12, 2020
https://nakedsecurity.sophos.com/2020/05/12/maze-ransomware-one-year-on-a-sophoslabs-report/

SophosLabs just published an informative report entitled Maze ransomware: extorting victims for 1 year and counting.

Although this ransomware has existed for more than twelve months, it was originally known simply as ChaCha, after the encryption algorithm it used.
From May 2019, however, the criminals behind it adopted the name “Maze”, and have even come up with their own visual “branding”

Sadly, Maze has been in the news quite frequently in recent months, notably because the gang who created it have been in the vanguard of a new wave of “double-whammy” ransomware attacks.
Click to expand...

The game has changed
As SophosLabs explains in the new report, the Maze crew was one of the first ransomware gangs out there to turn to a combination of blackmail and extortion, demanding that victims pay what is effectively hush money as well as a kidnap ransom.

With modern ransomware attacks typically targeting one organisation at a time, and with the Maze crew reportedly going after ransom payments running into hundreds of bitcoins, which comes out at millions of dollars, you can see why these crooks are willing to take time to steal victims’ data first.
Click to expand...

Sophos: Maze ransomware: extorting victims for 1 year and counting

mood · May 12, 2020

mood said: ↑

REvil ransomware threatens to leak A-list celebrities' legal docs
May 8, 2020
https://www.bleepingcomputer.com/ne...eatens-to-leak-a-list-celebrities-legal-docs/
Click to expand...

Will They Pay? Grubman Shire Responds to High-Stakes Ransomware Attack
May 12, 2020
https://www.digitalmusicnews.com/2020/05/12/grubman-shire-ransomware-response/

The law firm is starting the process of alerting its list of clients impacted by the theft. We reported on the high-security data breach yesterday – over 750 GB of data was stolen. Stolen data included contract provisions, with at least one leaked piece appearing to be from Madonna’s “Madame X” tour.

“We can confirm that we’ve been victimized by a cyberattack,” The New York law firm confirmed on Tuesday. “We have notified our clients and our staff. [Grubman Shire] have hired the world’s experts who specialize in this area, and we are working around the clock to address these matters.”
REvil is well-known among security researchers who monitor ransomware attacks.

In this type of attack, hackers ask the victim to pay a large amount of money in Bitcoin. If the victim does not, the hacker threatens to release the information publicly.
Click to expand...

mood · May 13, 2020

Ransomware now demands extra payment to delete stolen files
May 13, 2020
https://www.bleepingcomputer.com/ne...demands-extra-payment-to-delete-stolen-files/

A ransomware family has begun a new tactic of not only demanding a ransom for a decryptor but also demanding a second ransom not to publish files stolen in an attack.

It wasn't until November 2019, though, that the Maze ransomware operators actually followed through with this threat and publicly released stolen files.
Since then, almost all network-targeting ransomware families such as Maze, Sodinokibi, DopplePaymer, Clop, Sekhmet, Nephilim, Mespinoza, and Netwalker have adopted this practice and have created "leak" sites where they publish the stolen data of non-paying victims.
Click to expand...

Ako ransomware now demands two ransoms
In a new leak site created by the operators of the Ako Ransomware, the threat actors indicate that some companies are required to pay both a ransom payment for the decryptor and a separate amount to delete stolen files.

As an example, Ako has published the data for one of their victims and stated that they received a $350,000 payment for the decryptor, but released the files anyway after not receiving a payment to delete stolen files.
One of the Ako ransomware operators told BleepingComputer that this double-extortion tactic is only used on certain victims depending on the size of the company and the type of data that was stolen.

"company with big revenue scared when we talk about stolen files. so its motivation for other companies what need pay", the Ako operators told BleepingComputer.
Click to expand...

hawki · May 13, 2020

mood said: ↑

Will They Pay? Grubman Shire Responds to High-Stakes Ransomware Attack
May 12, 2020
https://www.digitalmusicnews.com/2020/05/12/grubman-shire-ransomware-response/
Click to expand...

"NYC attorney to likes of Lady Gaga, Elton John hacked, files held for $21M ransom

Hackers have attacked the website of top showbiz attorney Allen Grubman, demanding $21 million while threatening to reveal personal details of his clients including Elton John, Lady Gaga and Barbra Streisand..."

https://pagesix.com/2020/05/12/allen-grubmans-client-files-hacked-and-held-for-ransom/

mood · May 15, 2020

Ransomware recruits affiliates with huge payouts, automated leaks
May 15, 2020
https://www.bleepingcomputer.com/ne...affiliates-with-huge-payouts-automated-leaks/

The Netwalker ransomware operation is recruiting potential affiliates with the possibility of million-dollar payouts and an auto-publishing data leak blog to help drive successful ransom payments.
Promises of riches
In a series of posts to a Russian hacker forum shared with BleepingComputer by cyber intelligence firm Advanced Intelligence, the public-facing operator of the Netwalker ransomware has been interview affiliates for their program since March.
In a new post created over the weekend, Netwalker outlines all the improvements made to their operation, which include some very revealing data about ransom payments and new ways that they are extorting their victims.
Auto-publishing data leak site adds further leverage
In addition to the million-dollar payouts, Netwalker is promoting an auto-publishing data leak site that allows an affiliate to upload links to stolen data and then set a date when it should be publicly released.
Click to expand...

A tactic that has become common this year is for ransomware operators to steal unencrypted data from networks before performing the encryption.

Netwalker has gone one step further and created a leak site that allows their affiliates to create posts containing a victim's name, their description, links to their data, a password to open the data file, and the date and time that the data should be posted.
The site will then show a countdown for a particular victim's data reveal to provoke anxiety within their victims in the hopes it will coerce them into making a ransom payment.
Click to expand...

hawki · May 15, 2020

hawki said: ↑

"NYC attorney to likes of Lady Gaga, Elton John hacked, files held for $21M ransom

Hackers have attacked the website of top showbiz attorney Allen Grubman, demanding $21 million while threatening to reveal personal details of his clients including Elton John, Lady Gaga and Barbra Streisand..."

https://pagesix.com/2020/05/12/allen-grubmans-client-files-hacked-and-held-for-ransom/
Click to expand...

"Law firm hackers double ransom demand...

The ransom demand for the secret files of a cyber-attacked lawyer to A-list stars has doubled to $42 million...

Grubman, we’re told, is refusing to negotiate. A source said, 'His view is, if he paid, the hackers might release the documents anyway. Plus the FBI has stated this hack is considered an act of international terrorism, and we don’t negotiate with terrorists.'..."

https://pagesix.com/2020/05/14/la-law-firm-hackers-double-ransom-demand-threaten-donald-trump/

Minimalist · May 16, 2020

Criminal group that hacked law firm threatens to release Trump documents

A cybercriminal gang that hacked a major entertainment law firm claims it will release information on President Donald Trump if it doesn’t receive $42 million in ransom.

The group, a known criminal enterprise, didn’t offer any proof it had information compromising to Trump. It did, however, release a large set of stolen files from the law firm, Grubman Shire Meiselas & Sacks. NBC News reviewed some of the documents, and they appear legitimate.
Click to expand...

https://www.nbcnews.com/tech/securi...rm-threatens-release-trump-documents-n1208366

mood · May 16, 2020

The Week in Ransomware - May 15th 2020 - REvil targets Trump
May 16, 2020
https://www.bleepingcomputer.com/ne...ransomware-may-15th-2020-revil-targets-trump/

This week, we saw some interesting news about ransomware features being added and continued attackers against high profile victims.

The biggest news is REvil's continued threats against Grubman Shire Meiselas & Sacks (GSMLaw) after demanding a $21 million ransom. They have now increased the ransom to $42 million and have begun releasing emails that they state are damaging to President Trump.
From what was shared with BleepingComputer, it appears that the ransomware operators are bluffing.

On the feature side, Netwalker created a auto-publishing data leak blog to be used by affiliates. REvil also added new code that will automatically terminates processes keeping a file open that they are trying to encrypt. [...]
Click to expand...

mood · May 18, 2020

REvil hackers continue to wrack up high-profile targets with ransomware attacks
...now turned their sights to a major food company, Sherwood Forest and Harvest Distributors
May 18, 2020
https://www.darkowl.com/blog-conten...-high-profile-targets-with-ransomware-attacks

Since first leaking highly- sensitive personal information pertaining to Lady Gaga, the threat actor group has since targeted Sherwood Food Distributors and Donald Trump. [...]
REvil Announces New Target: Sherwood Food Distributors, LLC
The same group of hackers who just released highly sensitive data relating to Lady Gaga as a part of their ongoing extortion attempt of Grubman, Shire, Meiselas and Sacks has posted on the darknet that they are holding another company for ransom - Sherwood Food and Harvest Distributors. The threat actors posted a notice about their new target around 3pm MST 5/15.

This notice contained a link to download a portion of Sherwood's proprietary files as "previews" which they plan on releasing one at a time (8 in total). The first link to leaked information contains roughly 2,300 files.
The threat actors also posted a conversation they had with Coveware, a leading ransomware mitigation company, dating back to at least May 3rd.

This shows Sherwood has been aware of and dealing with this attack for over a week, and had not made this information public.
Click to expand...

SC Media: REvil attackers who threatened celebrity law firm, Trump, strike food distributor

“…Sherwood has been aware of and dealing with this attack for over a week, although it had not gone public, according to researchers at DarkOwl, who said the attackers posted a notice online Friday threatening to download eight of the company’s proprietary files as a preview of releases to come. The first link contains around 2,300 files.
Click to expand...

xxJackxx · May 18, 2020

If we would get rid of bitcoin and other anonymous currency this would all stop.

Minimalist · May 19, 2020

REvil Ransomware found buyer for Trump data, now targeting Madonna

The REvil ransomware group claims to have buyers ready for documents containing damaging information about US‌ President Donald Trump and is preparing to auction data on international celebrity Madonna.
Click to expand...

https://www.bleepingcomputer.com/ne...d-buyer-for-trump-data-now-targeting-madonna/

Minimalist · May 23, 2020

Ransomware Gang Posting Financial Details From Bank Attack

The Maze ransomware gang has started releasing payment card data from an attack that happened earlier this year at Banco BCR, which is the state-owned Bank of Costa Rica, according to several cybersecurity experts.
Click to expand...

https://www.databreachtoday.com/ransomware-gang-posting-financial-details-from-bank-attack-a-14335

mood · May 25, 2020

Hacker extorts online shops, sells databases if ransom not paid
May 25, 2020
https://www.bleepingcomputer.com/ne...ine-shops-sells-databases-if-ransom-not-paid/

More than two dozen SQL databases stolen from online shops in various countries are being offered for sale on a public website. In total, the seller provides over 1.5 million rows of records but the amount of stolen data is much larger.
The attacker is hacking into insecure servers that are reachable over the public web, copies the databases, and leaves a note asking for a ransom in return of the stolen data.
Money made
Victims have 10 days to pay BTC 0.06 ($525 at current price) a wallet provided in the ransom note, else the hacker makes the database public or uses it as they please.
E-commerce platforms targeted
There are 31 databases listed on the website, although judging from the number of abuse reports, this is clearly just a small portion. The most recent one is from March, and all have a sample attached for the potential buyers to check.

More than half of the listed databases are from online stores in Germany; others are from Brazil, the U.S., Italy, India, Spain, and Belarus. All run e-commerce platforms like Shopware, JTL-Shop, PrestaShop, OpenCart, Magento v1 and v2).
Click to expand...

mood · May 26, 2020

List of ransomware that leaks victims' stolen files if not paid
May 26, 2020
https://www.bleepingcomputer.com/ne...-that-leaks-victims-stolen-files-if-not-paid/

Starting last year, ransomware operators have escalated their extortion strategies by stealing files from victims before encrypting their data. These stolen files are then used as further leverage to force victims to pay.
Many ransomware operators have created data leak sites to publicly shame their victims and publish the files they stole.

Below is a list of ransomware operations that have a dedicated site for leaking data stolen from their victims.
Click to expand...

The list of ransomware with data leak sites
AKO Ransomware [...] CL0P Ransomware [...] DoppelPaymer Ransomware [...]
Maze Ransomware [...] Nemty Ransomware [...] Nephilim Ransomware [...]
Netwalker Ransomware [...] Pysa Ransomware (Mespinoza) [...]
Ragnar Locker Ransomware [...] REvil / Sodinokibi Ransomware [...]
Sekhmet Ransomware [...] Snatch Ransomware [...]
Click to expand...

Ransomware who leak data without dedicated sites
CryLock Ransomware [...] ProLock Ransomware [...] Snake Ransomware [...]

This list will be updated as other ransomware infections begin to leak data.
Click to expand...

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

hawki Registered Member

mood Updates Team

hawki Registered Member

Minimalist Registered Member

mood Updates Team

mood Updates Team

xxJackxx Registered Member

Minimalist Registered Member

Minimalist Registered Member

mood Updates Team

mood Updates Team

Log in or Sign up

Ransomware Gangs threaten to sell or publish Victims' Data if Not Paid

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

hawki Registered Member

mood Updates Team

hawki Registered Member

Minimalist Registered Member

mood Updates Team

mood Updates Team

xxJackxx Registered Member

Minimalist Registered Member

Minimalist Registered Member

mood Updates Team

mood Updates Team

Useful Searches