article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

A search at the breach-tracking service Constella Intelligence on the phone number in Tkaner’s registration records — 7.9521020220 — brings up multiple official Russian government documents listing the number’s owner as Dmitri Yurievich Khoroshev. 2011 said he was a system administrator and C++ coder.

article thumbnail

FBI Issues Flash Advisory on Conti Ransomware Attacks Impacting Healthcare and First Responder Networks

Hot for Security

Like most ransomware variants, Conti typically steals victims’ files and encrypts the servers and workstations in an effort to force a ransom payment from the victim,” the agency notes. The document contains valuable technical information regarding Conti’s modus operandi.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

ToddyCat: Keep calm and check logs

SecureList

The loader starts its activities by loading an encrypted payload from another file that should be present in the same directory. The main differences are the location and the filename of the encrypted file: %CommonApplicationData%Localuser.key and the decryption scheme used to obtain the final payload.

article thumbnail

Black Kingdom ransomware

SecureList

The ransomware is coded in Python and compiled to an executable using PyInstaller; it supports two encryption modes: one generated dynamically and one using a hardcoded key. Code analysis revealed an amateurish development cycle and a possibility to recover files encrypted with Black Kingdom with the help of the hardcoded key.

article thumbnail

Patch now! Microsoft Exchange attacks target ProxyShell vulnerabilities

Malwarebytes

This can only happen where organisations use the on-premise version of Exchange, and system administrators haven’t installed the April and May patches. Kevin Beaumont has documented how his Exchange honeypot detected exploitation by ProxyShell to drop a webshell. Ransomware.

article thumbnail

A member of the FIN7 group was sentenced to 10 years in prison

Security Affairs

The Ukrainian national Fedir Hladyr (35), aka “das” or “AronaXus,” was sentenced to 10 years in prison for having served as a manager and systems administrator for the financially motivated group FIN7 , aka Carbanak. Hladyr also controlled the organization’s encrypted channels of communication.”

article thumbnail

Lazarus APT Targeting Cryptocurrency, CISA Warns

SecureWorld News

CISA breaks down the tactics, techniques, and procedures (TTPs) used by the gang: "Intrusions begin with a large number of spearphishing messages sent to employees of cryptocurrency companies—often working in system administration or software development/IT operations (DevOps)—on a variety of communication platforms.