Remove 2014 Remove Cybercrime Remove Encryption Remove System Administration
article thumbnail

A member of the FIN7 group was sentenced to 10 years in prison

Security Affairs

The Ukrainian national Fedir Hladyr (35), aka “das” or “AronaXus,” was sentenced to 10 years in prison for having served as a manager and systems administrator for the financially motivated group FIN7 , aka Carbanak. Hladyr also controlled the organization’s encrypted channels of communication.”

article thumbnail

Microsoft warns of Human-Operated Ransomware as a growing threat to businesses

Security Affairs

Microsoft is warning of human-operated ransomware, this kind of attack against businesses is becoming popular in the cybercrime ecosystem. Human-operated ransomware is a technique usually employed in nation-state attacks that is becoming very popular in the cybercrime ecosystem. ” reads the post published by Microsoft.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

New Linux/DDosMan threat emerged from an evolution of the older Elknot

Security Affairs

2014), as described on the MMD blog when MMD detected 5 variants active under almost 15 panels scattered in China network. But let’s see what are the execution binaries and what an administrator will see because this analysis IS for rise the system administration awareness: Code execution: execve("/tmp/upgrade""); // to execute upgrade.

DDOS 84
article thumbnail

Ransomware Gangs and the Name Game Distraction

Krebs on Security

Reinvention is a basic survival skill in the cybercrime business. But a little more than a month later, a new ransomware affiliate program called BlackMatter emerged, and experts quickly determined BlackMatter was using the same unique encryption methods that DarkSide had used in their attacks. Image: FBI. sanctions.

article thumbnail

IT threat evolution Q2 2021

SecureList

The final payload is a remote administration tool that provides full control over the victim machine to its operators. Communication with the server can take place either over raw TCP sockets encrypted with RC4, or via HTTPS. The ransomware supports two encryption modes: one generated dynamically and one using a hardcoded key.