Security Affairs

AUGUST 10, 2021

The eCh0raix ransomware has been active since at least 2019, when eExperts from security firms Intezer and Anomali separately discovered sample of the ransomware targeting Network Attached Storage (NAS) devices. The malicious code appends.encrypt extension to filenames of encrypted files.

Ransomware 128

Ransomware Encryption Firmware Passwords 128

Security Affairs

JANUARY 16, 2022

Once the ransomware has infected a device, it moves all the files on the NAS into password-protected 7z archives and demands the payment of a $550 ransom. BleepingComputer also reported that dozens of ransom notes and encrypted files have been submitted to the ID-Ransomware service by affected QNAP users.

Ransomware 115

Ransomware Encryption Backups Firmware 115

Security Affairs

NOVEMBER 12, 2020

ESET has been aware of the existence of modules since the end of 2019 when its experts first spotted the “basic” components of the malware. One of the modules analyzed by the experts, named GetMicInfo, implements an algorithm that allows operators to gather database passwords by decrypting them from Windows registry values. .

Malware 134

Malware Architecture Passwords Engineering 134

Security Affairs

JUNE 6, 2020

The eCh0raix ransomware was appeared in the threat landscape in June 2019 by experts at security firms Intezer and Anomali. The ransomware, tracked by Intezer as “ QNAPCrypt ” and “ eCh0raix ” by Anomali, is written in the Go programming language and uses AES encryption to encrypt files. The malicious code appends .encrypt

Ransomware 110

Ransomware Encryption Advertising Manufacturing 110

Malwarebytes

MARCH 17, 2021

PYSA, aka Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. PYSA, also known as Mespinoza, was first spotted in the wild in October 2019 where it was initially used against large corporate networks. After this, PYSA is then deployed and executed.

Education 108

Education Ransomware Phishing Passwords 108

Security Affairs

MARCH 19, 2020

” According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. “ “The password database was leaked shortly before the attack. The malicious code appended the extension.

Government 107

Government Ransomware Encryption Penetration Testing 107

Security Affairs

JUNE 19, 2022

The ransomware, tracked by Intezer as “ QNAPCrypt ” and “ eCh0raix ” by Anomali, is written in the Go programming language and uses AES encryption to encrypt files. The malicious code appends.encrypt extension to filenames of encrypted files. 024 ($1,200) up to.06 06 bitcoins ($3,000). ” reported BleepingComputer. .

Ransomware 90

Ransomware Encryption Internet Internet 90

Security Affairs

JULY 26, 2021

Microsoft published mitigations for the recently discovered PetitPotam attack that allows attackers to force remote Windows machines to share their password hashes. The NTLM authentication hash can be used to carry out a relay attack or can be lately cracked to obtain the victim’s password.

Authentication 119

Authentication Passwords Encryption Hacking 119

Security Affairs

JANUARY 7, 2022

The eCh0raix ransomware has been active since at least 2019, when eExperts from security firms Intezer and Anomali separately discovered sample of the ransomware targeting Network Attached Storage (NAS) devices. The malicious code appends.encrypt extension to filenames of encrypted files.

Internet 88

Internet Internet Ransomware Encryption 88

Security Affairs

APRIL 2, 2021

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591. The joint alert also states that attackers scanning also enumerated devices for the CVE-2020-12812 and CVE-2019-5591 flaws. Implement the shortest acceptable timeframe for password changes.

Passwords 66

Passwords Government Firmware Accountability 66

Malwarebytes

MAY 28, 2021

The first is Ransom.Sodinokibi , which Malwarebytes has already profiled and has been detecting since 2019.). The files are then held for ransom and the victim is threatened by data loss, because of the encryption, and leaking of the exfiltrated data. Earlier versions appended the.CONTI extension to encrypted files.

Healthcare 111

Healthcare Ransomware Encryption Passwords 111

Security Affairs

AUGUST 13, 2022

The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have published a joint advisory to warn of Zeppelin ransomware attacks. To each encrypted file, it appends a randomized nine-digit hexadecimal number as an extension. ” reads the joint advisory. “The Pierluigi Paganini.

Ransomware 87

Ransomware Encryption Firmware Backups 87

Security Affairs

FEBRUARY 5, 2022

The LockBit ransomware gang has been active since September 2019, in June 2021 the group announced the LockBit 2.0 enumerates system information to include hostname, host configuration, domain information, local drive configuration, remote shares, and mounted external storage devices. Like other ransomware gangs, Lockbit 2.0

Ransomware 89

Ransomware Backups Encryption Accountability 89

Security Affairs

JANUARY 8, 2021

The loader observed by the researchers in the attacks is written in Golang and borrows the Ezuri code published on GitHub by the user guitmz in March 2019. Upon executing the code, it will ask the user the path for the payload to be encrypted and the password to be used for AES encryption to hide the malware within the loader.

Malware 135

Malware Encryption Antivirus Passwords 135

Security Affairs

MARCH 14, 2023

Their operations are based on the human operator ransomware practice where most of the intrusion is handled by hands-on keyboard criminals, even in the encryption stage. The tool is able to automatically retrieve local users from groups, filter for administration, and then test the password. Advanced_Port_Scanner_2.5.3869.exe

Ransomware 84

Ransomware Software System Administration Encryption 84

Security Affairs

MARCH 17, 2021

According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. Once compromised the target network, attackers attempt to exfiltrate the company’s accounts and passwords database.

Education 95

Education Ransomware Encryption Antivirus 95

Security Affairs

MARCH 18, 2023

” The Lockbit gang has been active since at least 2019 and today it is one of the most active ransomware groups offering a Ransomware-as-a-Service (RaaS) model. ransomware, then a password argument is mandatory during the execution of the ransomware.” “LockBit 3.0 and LockBit.” The LockBit 3.0

Ransomware 82

Ransomware Penetration Testing Encryption Accountability 82

Security Affairs

JULY 28, 2020

CGI password logger This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page. These are encrypted with the actor’s public key and sent to their infrastructure over HTTPS. The QSnatch malware implements multiple functionalities, such as: .

Malware 106

Malware Firmware Advertising Manufacturing 106

Security Affairs

SEPTEMBER 29, 2022

The gang has been active since at least 2019 and today it is one of the most active ransomware gangs. The builder is contained in a password-protected 7z archive, “LockBit3Builder.7z,” BleepingComputer researchers, who tested the Bl00dy Ransomware Gang’s encrypter, confirmed that it was generated with the leaked LockBit 3.0.

Ransomware 105

Ransomware Hacking Encryption Passwords 105

The Last Watchdog

JUNE 21, 2020

Although most people think of ransomware as a dodgy application that encrypts data and holds it for ransom, the concept is much more heterogeneous than that. The Archiveus Trojan from 2006 was the first one to use RSA cipher, but it was reminiscent of a proof of concept and used a static 30-digit decryption password that was shortly cracked.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

Security Affairs

NOVEMBER 19, 2019

Ransomware accounted for over half of all malicious mailings in H1 2019, Troldesh aka Shade being the most popular tool among cybercriminals. The first half of 2019 saw a 10-fold increase in the number of password-protected objects, such as documents and archive files, being used to deliver malware. The revival of ransomware.

Ransomware 71

Ransomware Antivirus Malware Banking 71

Security Affairs

OCTOBER 1, 2019

Exposed data include login username, name, email address, hashed passwords, last IP address used to access the forums, and some social media usernames for a limited number of users. ” reads the security notice published by Comodo. ” reads the security notice published by Comodo. ” recommends Comodo.

Passwords 76

Passwords Data breaches Advertising Hacking 76

Security Affairs

DECEMBER 22, 2021

According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. Once compromised the target network, attackers attempt to exfiltrate the company’s accounts and passwords database.

Ransomware 100

Ransomware Penetration Testing Healthcare Government 100

Security Affairs

AUGUST 2, 2020

The first campaign likely began in early 2014 and continued until mid-2017, while the second started in late 2018 and was still active in late 2019. These are encrypted with the actor’s public key and sent to their infrastructure over HTTPS. Install and update Security Counselor. Change the admin password and use a strong one.

Malware 99

Malware Advertising Passwords Manufacturing 99

Security Affairs

OCTOBER 2, 2019

Zendesk discloses a data breach that took place in 2016 when a hacker accessed data of 10,000 users, including passwords, emails, names, and phone numbers. In 2016, customer service software company Zendesk suffered a security breach that exposed data of 10,000 users, including passwords, emails, names, and phone numbers.

Data breaches 77

Data breaches Passwords Authentication Accountability 77

Security Affairs

MARCH 22, 2020

The expert Bob Diachenko has discovered an unsecured Elasticsearch install belonging to a UK security firm that contained 5 billion records of data leaked in previous incidents that took place between 2012 and 2019. ” wrote Security Discovery’s researcher Bob Diachenko.

Data breaches 99

Data breaches DNS Advertising Engineering 99

Security Affairs

OCTOBER 20, 2021

Financially motivated threat actors are using Cookie Theft malware in phishing attacks against YouTube creators since late 2019. “Most of the observed malware was capable of stealing both user passwords and cookies. A few were observed displaying a fake error message requiring user click-through to continue execution.”

Accountability 127

Accountability Malware Phishing Social Engineering 127

SecureList

FEBRUARY 1, 2022

times against 2019. This was based on an analysis of information published on the dark web. In 2021, HIPAA noted 642 data leaks from medical organizations versus 512 in 2019. Let’s see if there are any informational security issues with these wearables. Source: HIPAA Journal.

Phishing 119

Phishing Healthcare IoT Authentication 119

Security Affairs

OCTOBER 30, 2019

“On October 16, 2019, Network Solutions determined that a third-party gained unauthorized access to a limited number of our computer systems in late August 2019, and as a result, account information may have been accessed,” reads a security breach notice. ” continues the notice.

Data breaches 52

Data breaches Accountability Advertising Encryption 52

Security Affairs

AUGUST 7, 2019

Experts discovered a new Spectre speculative execution flaw (SWAPGS attack), tracked as CVE-2019-1125, that affects all Modern Intel CPUs and some AMD processors. Speculative execution is a core component of modern microprocessor designed to improve performance, unfortunately, they could lead to information disclosure.

Advertising 90

Advertising Encryption Passwords Hacking 90

Security Affairs

AUGUST 4, 2020

The malware has been active at least since August 2019, over the months the NetWalker ransomware was made available through a ransomware-as-a-service (RaaS) model attracting criminal affiliates. “Since 2019, NetWalker ransomware has reached a vast number of different targets, mostly based in western European countries and the US.

Ransomware 77

Ransomware VPN Cybercrime Advertising 77

Security Affairs

FEBRUARY 9, 2020

In December 2019, Maastricht University (UM) announced that ransomware infected almost all of its Windows systems on December 23. It is unclear if the attackers have exfiltrated data from the systems before encrypting them. The attacker focused on encrypting data files in the Windows domain.

Ransomware 108

Ransomware Cyber Attacks Architecture Backups 108

Security Affairs

NOVEMBER 14, 2019

The flaws affect the first of the above implementations, the Qualcomm’s Secure Execution Environment (QSEE). The QSEE is a sort of hardware enclave that protects sensitive information (i.e. private encryption keys, passwords, payment card credentials) and offers a separate secure environment for executing Trusted Applications.

Mobile 83

Mobile Advertising Manufacturing Media 83

Security Affairs

DECEMBER 5, 2021

According to Talos, the threat actor has been active at least since late 2018, experts observed intermittent activity towards the end of 2019 and through early 2020. Upon executing the fake installers, they execute the following pieces of malware on the victim’s system: A password stealer called RedLine Stealer.

Passwords 85

Passwords Software Backups Malware 85

Security Affairs

NOVEMBER 21, 2019

“Fast forwarded to October 11, 2019, our Anglerfish honeypot captured another suspicious ELF sample, and it turned out to be the Downloader of the previous suspicious ELF sample.” T he experts first spotted the Roboto botnet in August when they detected a suspicious ELF file. ” reads the analysis published by 360 Netlab.

DDOS 81

DDOS System Administration Advertising DNS 81

Security Affairs

JULY 30, 2019

Experts discovered two critical security issues that affect recent versions of Enterprise, Professional, and Community Editions of OXID eShop software. The first issue, tracked as CVE-2019-13026, is an SQL injection vulnerability that could be exploited by an unauthenticated attacker to create a new administrator account.

eCommerce 62

eCommerce Hacking Advertising Software 62

Security Affairs

OCTOBER 8, 2019

grabbed the decryption keys from his server and put these public, you can now decrypt for free: [link] — Bot (@battleck) October 7, 2019. The gang behind the Muhstik ransomware is brute-forcing QNAP NAS devices that use weak passwords for the built-in phpMyAdmin service. ” states the security advisory published by QNAP.

Hacking 84

Hacking Ransomware Advertising Passwords 84