Security Affairs

NOVEMBER 19, 2023

Phobos variants are usually distributed by the SmokeLoader , but in 8Base campaigns, it has the ransomware component embedded in its encrypted payloads. 8base” file extension for encrypted documents, a circumstance that suggested a possible link to the 8Base group or the use of the same code-base for their ransomware.

Ransomware 128

Ransomware Encryption Backups Manufacturing 128

Security Affairs

NOVEMBER 1, 2020

The Maze ransomware operators are shutting down their operations for more than one year the appeared on the threat landscape in May 2019. The Maze cybercrime gang is shutting down its operations, it was considered one of the most prominent and active ransomware crew since it began operating in May 2019.

Ransomware 144

Ransomware Cybercrime Advertising Software 144

Spinone

DECEMBER 24, 2018

According to Juniper Research , cybercrime is estimated to become a $2.1 trillion dollar issue by 2019. Based on the “Key findings from the Global State of Information Security® Survey 2017” by PricewaterhouseCoopers , over 28 percent of respondents have become the victims of mobile hacking.

Encryption 61

Encryption Mobile Computers and Electronics Government 61

Security Affairs

FEBRUARY 24, 2020

The Raccoon stealer was first spotted in April 2019, it was designed to steal victims’ credit card data, email credentials, cryptocurrency wallets, and other sensitive data. The post Raccoon Malware, a success case in the cybercrime ecosystem appeared first on Security Affairs. ” continues the analysis.

Cybercrime 91

Cybercrime Malware Cryptocurrency Advertising 91

Security Affairs

JANUARY 6, 2023

The MegaCortex ransomware first appeared on the threat landscape in May 2019 when it was spotted by security experts at Sophos. Since November 2019, MegaCortex operators started adopting double extortion tactics. The decryptor also supports the “Scan Entire System” mode which allows users to search for all encrypted files.

Ransomware 97

Ransomware Antivirus Encryption Backups 97

Security Affairs

OCTOBER 26, 2019

Even though encryption should be taken seriously by businesses of all sizes, only a small fraction of the corporate sector puts their back on it. According to Juniper Research , up to 13% of the cybercrime market thrives because of the small business. Why is Encryption a Feasible Option against Digital Threats? Final Thoughts.

Encryption 47

Encryption Cyber threats Ransomware Cybercrime 47

Security Affairs

JANUARY 5, 2020

DeathRansom was considered fake ransomware due to the fact that it did not implement an effective encryption process, but now things are changing. DeathRansom is a ransomware family that was initially classified as a joke because it did not implement an effective encryption scheme. Pierluigi Paganini.

Encryption 67

Encryption Ransomware Malware Scams 67

Security Affairs

DECEMBER 27, 2021

The attackers first create a user in the administrator group, then use it to encrypt the content of the NAS. “It is important to note that there is a free decryptor for files locked with an older version (before July 17th, 2019) of eCh0raix ransomware. The malicious code appends.encrypt extension to filenames of encrypted files.

Ransomware 128

Ransomware Encryption Manufacturing Hacking 128

Security Affairs

OCTOBER 3, 2023

Like all ransomware, this is a type of malware that, once introduced into an organization, encrypts the data and then requires the victim to pay a ransom in order to decrypt it. Encrypted file structure ransomware BlackCat / ALPHV: [ORIGINAL_FILENAME].[ORIGINAL_extension].specific/different Black The LockBit 3.0 ORIGINAL_extension].specific/different

Ransomware 123

Ransomware Encryption Technology Backups 123

Security Affairs

JANUARY 18, 2022

Europol this week announced the shutdown of VPNLab, a VPN service that is very popular in the cybercrime ecosystem. An international operation conducted by law enforcement bodies from 10 countries took down VPNLab.net, a VPN service provider that is very popular in the cybercrime ecosystem.

VPN 88

VPN Cybercrime Ransomware Advertising 88

Security Affairs

FEBRUARY 23, 2022

In a first stage it allocates the memory space where to copy the encrypted data and whose content is executed by the packer. Then, in the second stage the packer decrypts the code into another portion of the same memory allocation where it stored the encrypted data, and then transfers the execution to this second layer.

Ransomware 100

Ransomware Malware Cybercrime Banking 100

Security Affairs

JANUARY 28, 2022

According to CTWANT , which cited an undisclosed information security company, Delta Electronics was hit by Conti ransomware that asked Delta to pay a $15 million ransom to restore encrypted files and avoid their leak. ” reported a statement from the security company cited by CTWANT.

Computers and Electronics 94

Computers and Electronics Ransomware Manufacturing Malware 94

Security Affairs

DECEMBER 10, 2021

In addition to the encryption of data and subsequent impact to organisations’ ability to operate as usual, victims have had data stolen during incidents published by the ransomware actors, including Personally Identifiable Information (PII).” This activity has happened across multiple sectors.

Ransomware 96

Ransomware Cybercrime Encryption Malware 96

Security Affairs

MARCH 19, 2020

” According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. “On one of the compromised information systems, experts found encrypted files with the extension “ newversion.”

Government 110

Government Ransomware Encryption Penetration Testing 110

Security Affairs

JANUARY 28, 2023

The recent Hive infrastructure takedown as well as other major gangs dissolution such as Conti in 2022, is making room in the cybercrime business The Lockbit locker leaked a few months ago in the underground, is increasing its popularity and adoption among micro-criminal actors.

Penetration Testing 94

Penetration Testing Ransomware Firewall Social Engineering 94

Security Affairs

AUGUST 10, 2021

The eCh0raix ransomware has been active since at least 2019, when eExperts from security firms Intezer and Anomali separately discovered sample of the ransomware targeting Network Attached Storage (NAS) devices. The malicious code appends.encrypt extension to filenames of encrypted files.

Ransomware 128

Ransomware Encryption Firmware Passwords 128

Security Affairs

NOVEMBER 4, 2020

The good news that the company excluded the theft of internal information. billion in revenue for 2019. The company filed a 10-Q form with the Securities and Exchange Commission (SEC), Mattel disclosed that it suffered a ransomware attack on July 28th, 2020. ” reads the 10-Q form.

Ransomware 115

Ransomware Retail Advertising Malware 115

Security Affairs

JULY 15, 2019

Cybercrime gang tracked as TA505 has been active since 2014 and focusing on Retail and Banking industries. This new variant was behind a series of ransomware campaigns beginning in June 2019, including attacks against the City of Edcouch, Texas and the Chilean Ministry of Agriculture.” ” continues the analysis.

Ransomware 74

Ransomware Encryption Advertising Malware 74

Security Affairs

MARCH 29, 2020

.” reads the post published by “This, in turn, would result in the broader proliferation among multiple cybercrime groups, and an eventual surge in attacks.” The Dharma ransomware received numerous updates over the years, in 2019 a new piece of ransomware subbed Phobos emerged online. ” concluded ZDNet.

Ransomware 113

Ransomware Hacking Advertising Malware 113

Security Affairs

NOVEMBER 3, 2021

The decision of the gang comes after the recent announcement of closer collaboration of US and Russian authorities in curbing cybercriminal organizations based in Russia, such as the FIN7 cybercrime gang. The list of victims of the group also includes Norwegian giant Norsk Hydr that was hit in 2019. Pierluigi Paganini.

Ransomware 117

Ransomware Cybercrime Healthcare Encryption 117

Security Affairs

JUNE 22, 2023

” The researchers pointed out that the Mirai variant like IZ1H9 and V3G4 will first initialize an encrypted string table and then retrieve the strings through an index. Since March 2023, researchers at Palo Alto Networks Unit 42 have observed a new variant of the Mirai botnet targeting multiple vulnerabilities in popular IoT devices.

IoT 91

IoT Malware Encryption DDOS 91

Security Affairs

JANUARY 6, 2023

. “The attack is similar to the one in the summer of 2019, when four other hospitals in Romania were targeted. “The hackers entered the system and encrypted the December database. “We have already notified the National Directorate of Cyber Security and DIICOT. ” reported the website Romania Insider.

Ransomware 88

Ransomware Antivirus Media Encryption 88

The Last Watchdog

JUNE 21, 2020

Although most people think of ransomware as a dodgy application that encrypts data and holds it for ransom, the concept is much more heterogeneous than that. File encryption 2013 – 2015. It emerged in September 2013 and paved the way for hundreds of file-encrypting menaces that have splashed onto the scene ever since.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

Security Affairs

DECEMBER 24, 2019

“Since January 2019, LockerGoga ransomware has targeted large corporations and organizations in the United States, United Kingdom, France, Norway, and the Netherlands. Feds remind that both ransomware implements a secure encryption algorithm that means it impossible to decrypt the files without paying the ransom.

Ransomware 63

Ransomware Backups Encryption Cyber Attacks 63

Security Affairs

AUGUST 4, 2020

NetWalker ransomware operators continue to be very active, according to McAfee the cybercrime gang has earned more than $25 million since March 2020. The malware has been active at least since August 2019, over the months the NetWalker ransomware was made available through a ransomware-as-a-service (RaaS) model attracting criminal affiliates.

Ransomware 76

Ransomware VPN Cybercrime Advertising 76

Security Affairs

SEPTEMBER 22, 2021

. “The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have observed the increased use of Conti ransomware in more than 400 attacks on U.S. In typical Conti ransomware attacks, malicious cyber actors steal files, encrypt servers and workstations, and demand a ransom payment.”

Ransomware 102

Ransomware Cybercrime Authentication Healthcare 102

Security Affairs

AUGUST 3, 2020

He had no previous criminal records at the time of the arrest, but it is known to be a member of a cybercrime forum to become an affiliate for the GandCrab ransomware operation. ransom amount, individual bots and encryption masks). Close of GandCrab Ransomware : 1-6-2019. million dollars per week.

Ransomware 122

Ransomware Advertising Malware Hacking 122

Security Affairs

DECEMBER 15, 2019

Over the weekend, New Orleans officials announced in a press conference that the city was hit by a ransomware attack, the incident was discovered in the morning of December 13, 2019. The IT staff immediately informed all employees of the incident and asked them to power down computers to avoid the threat spreading. Pierluigi Paganini.

Ransomware 77

Ransomware Advertising Cybercrime Media 77

Security Affairs

JANUARY 15, 2020

The cybercrime group behind Satan ransomware and other malware seems to be involved in the development of a new threat named 5ss5c. ru ) to the file name of each encrypted file, for example test.txt becomes [5ss5c@mail.ru ] test. SecurityAffairs – cybercrime, ransomware). ” reads the analysis published by Blaze.

Ransomware 73

Ransomware Cybercrime Architecture Advertising 73

Security Affairs

MARCH 17, 2021

According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. The attackers implement a double extortion model using the PYSA ransomware to exfiltrate data from victims prior to encrypting their files.

Education 99

Education Ransomware Encryption Antivirus 99

Security Affairs

AUGUST 13, 2022

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have published a joint advisory to warn of Zeppelin ransomware attacks. To each encrypted file, it appends a randomized nine-digit hexadecimal number as an extension. ” reads the joint advisory. “The Pierluigi Paganini.

Ransomware 91

Ransomware Encryption Firmware Backups 91

Security Affairs

MAY 19, 2021

Conti ransomware also breached the network of Ireland’s Department of Health (DoH) but the ransomware failed to encrypt the systems. In a separate attack, the ransomware gang also breached the network of the country’s Department of Health (DoH) but failed to encrypt the systems of the organization.

Ransomware 88

Ransomware Encryption Malware Government 88

Security Affairs

MARCH 14, 2023

Their operations are based on the human operator ransomware practice where most of the intrusion is handled by hands-on keyboard criminals, even in the encryption stage. The Makop criminals were recently using version 2.5.3869 of the tool, which dates back to 2019. Advanced_Port_Scanner_2.5.3869.exe

Ransomware 88

Ransomware Software System Administration Encryption 88

Security Affairs

OCTOBER 25, 2022

NET framework” and uses encrypted communication channel to avoid detection. On July 18, 2019, the source code for MajikPOS (aka MagicPOS) was offered for sale on the cybercrime forum “exploit[.]in” MajikPOS is written using the “.NET in” by the user cartonash.

Malware 85

Malware Cybercrime Banking Marketing 85

Security Affairs

APRIL 9, 2020

million ransom to decrypt its files after being encrypted by the infamous Sodinokibi ransomware. “As part of this attack, the operators behind the Sodinokibi ransomware told BleepingComputer that they had encrypted the company’s entire network, deleted backup files, and copied more than 5GB of personal data.

Ransomware 120

Ransomware Encryption Advertising Backups 120

Security Affairs

OCTOBER 24, 2020

The ransomware encrypted files and renamed their filenames by adding the “ easy2lock” extension, this extension was previously associated with recent WastedLocker ransomware infections. This group has been active since at least 2007, in December 2019, the U.S.

Ransomware 91

Ransomware Telecommunications Banking Advertising 91

Malwarebytes

MAY 28, 2021

The first is Ransom.Sodinokibi , which Malwarebytes has already profiled and has been detecting since 2019.). The files are then held for ransom and the victim is threatened by data loss, because of the encryption, and leaking of the exfiltrated data. Earlier versions appended the.CONTI extension to encrypted files.

Healthcare 109

Healthcare Ransomware Encryption Passwords 109