Ransomware Groups to Watch: Emerging Threats

guest · Aug 24, 2021

Researchers Warn of 4 Emerging Ransomware Groups That Can Cause Havoc
August 24, 2021
https://thehackernews.com/2021/08/researchers-warn-of-4-new-ransomware.html

Cybersecurity researchers on Tuesday took the wraps off four up-and-coming ransomware groups that could pose a serious threat to enterprises and critical infrastructure, as the ripple effect of a recent spurt in ransomware incidents show that attackers are growing more sophisticated and more profitable in extracting payouts from victims.

"While the ransomware crisis appears poised to get worse before it gets better, the cast of cybercrime groups that cause the most damage is constantly changing," Palo Alto Networks' Unit 42 threat intelligence team said in a report shared with The Hacker News.
Click to expand...

Chief among the new entrants is AvosLocker, a ransomware-as-a-service (RaaS) group that commenced operations in late June via "press releases" that are branded with a blue beetle logo to recruit new affiliates.

If anything, the emergence of new ransomware variants show that cybercriminals are doubling down on ransomware attacks, underscoring the extremely profitable nature of the crime.

"With major ransomware groups such as REvil and DarkSide lying low or rebranding to evade law enforcement heat and media attention, new groups will emerge to replace the ones that are no longer actively targeting victims," the researchers said. "While LockBit and HelloKitty have been previously active, their recent evolution makes them a good example on how old groups can re-emerge and remain persistent threats."
Click to expand...

Palo Alto Networks - Unit42: Ransomware Groups to Watch: Emerging Threats

As part of Unit 42’s commitment to stop ransomware attacks, we conduct ransomware hunting operations to ensure our customers are protected against new and evolving ransomware variants. We monitor the activity of existing groups, search for dark web leak sites and fresh onion sites, identify up-and-coming players and study tactics, techniques and procedures. During our operations, we have observed four emerging ransomware groups that are currently affecting organizations and show signs of having the potential to become more prevalent in the future:
Click to expand...

AvosLocker is ransomware as a service (RaaS) that started operations in late June, using a blue beetle logo to identify itself in communications with victims and “press releases” aimed at recruiting new affiliates. AvosLocker was observed promoting its RaaS program and looking for affiliates on dark web discussion forums and other forums.

Hive Ransomware is double-extortion ransomware that started operations in June. Since then, Hive has impacted 28 organizations that are now listed on the group’s extortion site, including a European airline company and three U.S.-based organizations.

HelloKitty is not a new ransomware group; it can be tracked as early as 2020, mainly targeting Windows systems. However, in July, we observed a Linux variant of HelloKitty targeting VMware’s ESXi hypervisor, which is widely used in cloud and on-premises data centers.

LockBit 2.0 (previously known as ABCD ransomware) is a three-year-old RaaS operator that has been linked to some high-profile attacks lately following the June launch of a slick marketing campaign to recruit new affiliates.

Click to expand...

EASTER · Aug 24, 2021

Good info @mood- Just because the world is somewhat of a lull right now after a series of STRONG high profile organization breakins from ransomware, doesn't mean that their not gearing up for another WAVE.

guest · Aug 26, 2021

7 Emerging Ransomware Groups Practicing Double Extortion
August 26, 2021
https://www.databreachtoday.com/7-emerging-ransomware-groups-practicing-double-extortion-a-17384

After a string of high-profile hits in the middle of this year, a number of the largest and most notorious ransomware operations disappeared.

As always, new ransomware gangs regularly debut. In recent weeks, law enforcement officials and information security experts have been tracking a surge in activity from lesser-known players, including the emergence of new operations. All use double extortion, meaning they claim to steal data before crypto-locking systems, and threaten to leak the stolen data to a data-leak site unless victims pay.
Here are more details on seven such operations: ALTDOS, AvosLocker, Hive, HelloKitty, LockBit 2.0 and OnePercent Group, as well as the DarkSide spinoff BlackMatter.
Click to expand...

1. ALTDOS
This week, Singapore's Cyber Security Agency, police force and Personal Data Protection Commission warned that the ALTDOS cybercrime operation, since appearing last December, has continued to target organizations in Bangladesh, Singapore and Thailand.

"It is currently unknown which ransomware variant is employed by ALTDOS," according to their joint advisory on ALTDOS. "ALTDOS will … contact the victim using an email address hosted on ProtonMail demanding that payment be made or the exfiltrated data will be published."
2. AvosLocker
This operation was first spotted in June, with researchers saying it appeared to be focusing on smaller law firms, as well as freight, logistics and real estate firms, in the U.S., the U.K. and parts of Europe.

"Like many of its competitors, AvosLocker offers technical support to help victims recover after they've been attacked with encryption software that the group claims is 'fail-proof,' has low detection rates and is capable of handling large files," say Doel Santos and Ruchna Nigam of Palo Alto's Unit 42 threat research group in a blog post. "We have observed initial ransom demands ranging from $50,000 to $75,000."
Click to expand...

3. Hive Ransomware
Experts say newcomer Hive ransomware, first spotted on June 26 by the self-described South Korea-based "ransomware hunter" behind the @fbgwls245 Twitter account, who spotted the group's malicious executable after it was uploaded to the VirusTotal malware-scanning service.
On Thursday, Hive's data-leak site listed 34 victims.

While the group may have already honed its shakedown tactics, however, the research and intelligence team at BlackBerry recently said that, based on observed samples of Hive, the malware appears to be very much "still under development."
Click to expand...

4. HelloKitty
Attacks involving HelloKitty ransomware were first spotted in early 2020.

In July, the Palo Alto researchers say they spotted "a Linux variant of HelloKitty targeting VMware's ESXi hypervisor, which is widely used in cloud and on-premises data centers."
Palo Alto says that HelloKitty-wielding attackers have demanded ransoms of up to $10 million, but they recently received a trio of large ransoms that added up to just $1.5 million.
Click to expand...

5. LockBit 2.0

"LockBit 2.0 prides itself on having one of the fastest and most efficient encryption methods in today's ransomware threat landscape," security firm Trend Micro said in a recent report.
In an apparent bid to increase the group's profile and attract new affiliates, a spokesman for the group, who goes by "LockBitSupp," recently granted an interview to the Russian OSINT YouTube channel, extoling the virtues of his operation program, which he says remits 80% of every ransom paid to the responsible affiliate.
As of Thursday, the LockBit 2.0 leak site listed 64 victims, some of which had their stolen information already published, and others for which a countdown timer is still running.
6. OnePercent Group
Together with PowerShell scripting, the attackers move laterally across the network, using the Rclone tool to exfiltrate data to cloud storage before ultimately deploying their crypto-locking malware on every possible, the FBI says.

For any victims who refuse to pay, the group has previously threatened to sell the stolen data to the REvil, aka Sodinokibi group, it says.
Click to expand...

7. BlackMatter Ransomware
After analyzing a BlackMatter decryptor found in the wild, however, ransomware-hunting expert Fabian Wosar, CTO of security firm Emsisoft, announced: "I am convinced that we are dealing with a DarkSide rebrand here."
Click to expand...

guest · Aug 27, 2021

CISA
FBI Releases Indicators of Compromise Associated with Hive Ransomware
August 27, 2021
https://us-cert.cisa.gov/ncas/curre...icators-compromise-associated-hive-ransomware

The Federal Bureau of Investigation (FBI) has released a Flash report detailing indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with ransomware attacks by Hive, a likely Ransomware-as-a-Service organization consisting of a number of actors using multiple mechanisms to compromise business networks, exfiltrate data and encrypt data on the networks, and attempt to collect a ransom in exchange for access to the decryption software.

CISA encourages users and administrators to review the technical details, IOCs, and TTPs in FBI Flash MC-000150-MW and apply the recommend mitigations.
Click to expand...

FBI Flash Report (PDF): https://www.ic3.gov/Media/News/2021/210825.pdf

The FBI issued a flash alert for Hive ransomware operations
August 27, 2021
https://securityaffairs.co/wordpress/121518/malware/fbi-alert-hive-ransomware.html

The Federal Bureau of Investigation (FBI) has released a flaw alert on the Hive ransomware attacks that includes technical details and indicators of compromise associated with the operations of the gang.

Hive ransomware has been active since June 2021, it implements a Ransomware-as-a-Service model and employs a wide variety of tactics, techniques, and procedures (TTPs). Government experts state that the group uses multiple mechanisms to compromise networks of the victims, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network.
Click to expand...

The flash alert provides indicators of compromise (IoCs), including the onion address of the leak site (http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion) used by the gang.
The group also relies on multiple file-sharing services, including Anonfiles, MEGA, Send.Exploit, Ufile, or SendSpace.

A few days ago, the Federal Bureau of Investigation (FBI) has published another flash alert about a threat actor known as OnePercent Group that has been actively targeting US organizations in ransomware attacks since at least November 2020.
Click to expand...

FBI Flash - Hive Ransomware IoCs

guest · Nov 1, 2021

FBI: HelloKitty ransomware adds DDoS attacks to extortion tactics
November 1, 2021
https://www.bleepingcomputer.com/ne...mware-adds-ddos-attacks-to-extortion-tactics/

The U.S. Federal Bureau of Investigation (FBI) has sent out a flash alert warning private industry partners that the HelloKitty ransomware gang (aka FiveHands) has added distributed denial-of-service (DDoS) attacks to their arsenal of extortion tactics.

In a Friday notification coordinated with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI said that the ransomware group would take their victims' official websites down in DDoS attacks if they didn't comply with the ransom demands.

"In some cases, if the victim does not respond quickly or does not pay the ransom, the threat actors will launch a Distributed Denial of Service (DDoS) attack on the victim company's public facing website," the FBI said.
"Hello Kitty/FiveHands actors demand varying ransom payments in Bitcoin (BTC) that appear tailored to each victim, commensurate with their assessed ability to pay it. If no ransom is paid, the threat actors will post victim data to the Babuk site payload.bin) or sell it to a third-party data broker."
Click to expand...

The FBI also shared an extensive collection of indicators of compromise (IOCs) in their alert to help cybersecurity professionals and system admins to guard against attack attempts coordinated by the HelloKitty ransomware gang.
Click to expand...

FBI flash alert warning
(PDF): https://www.ic3.gov/Media/News/2021/211029.pdf

guest · Dec 23, 2021

AvosLocker Ransomware Attacks Spike
The emergence of AvosLocker is part of an overarching shift in the RaaS ecosystem over the latter half of 2021
December 22, 2021

Ransomware attacks using the AvosLocker family have spiked over the past few weeks, researchers warned in a new analysis, with the ransomware-as-a-service (RaaS) starting to make a “significant effort” to disable endpoint security products on targeted systems.

Before executing the ransomware, attackers reboot infected machines in Windows Safe Mode, which is a special diagnostic configuration that disables third-party drivers and software and enables users to run diagnostic tests on the operating system.

“The reason for this is that many, if not most, endpoint security products do not run in Safe Mode,” according to Andrew Brandt with Sophos on Wednesday.
“Working in Safe Mode makes the job of protecting computers all the more difficult, because Microsoft does not permit endpoint security tools to run in Safe Mode.”
Click to expand...

Previously, ransomware families like Snatch, REvil and BlackMatter have utilized this tactic of rebooting in Safe Mode before execution. AvosLocker goes a step further by modifying the Safe Mode configuration so that attackers can also install and utilize the IT management tool AnyDesk even when Safe Mode is running.
Click to expand...

Log in or Sign up

Ransomware Groups to Watch: Emerging Threats

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware Groups to Watch: Emerging Threats

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches