May 19, 2019
Home » ransomware

ransomware

Malware
FIN6 Group on cybercrime evolves from POS Malware to ransomware
Moseley (Raam) Posted On April 8, 2019

Malware to ransomware

FireEye: The group FIN6 is now implementing Ryuk and LockerGoga ransomware strains on hacked company networks from which POS data can not be stealed.

A cybercrime group, known mainly to hack retailers and steal payment card information from point – of – sale (POS) systems, has changed its tactics and is now also deployed on infected networks.

The group, FIN6, is reputed to be one of the most advanced cybercriminals in the field of cybersecurity. The activities of FireEye were initially documented in spring 2016 when a first report was published detailing the extensive hacking and advanced arsenal.

The group developed a multi-faceted POS malware strain called Trinity (a FrameworkPOS). FIN6 would hack in major retailer networks, move over their systems laterally and deploy Trinity on computers that handle POS data so that it could extract payment card information, which it would then upload on its own servers.

By selling these stolen card details on the forum, the group would make money and raise millions of US dollars.

Fin: RANSOMWARE DEPLOYING SINCE JULY 2018

However, according to a new report published by FireEye on Friday, 5 April, the group is now deploying POS – not – managing ransomware on some hacked networks.

And the group did not drop just ransomware of any kind. The group has been deploying Ryuk and LockerGoga ransomware strains since July 2018, says FireEye.

Both of these strains were at the heart of a high – profile infection wave that crippled both governmental organizations and large private sector companies – Norsk Hydro being the latest victim.

The group is believed to be operating from Russia, where it rents infrastructures to large companies (Emote, and TrickBot), that it would eventually infect Trinity, Ryuk or LockerGoga, according to previous reports from Crowd Strike, FireEye, Kryptos Logic, McAfee, IBM and Cybereason.

ryuk-workflow

Image:Kryptos Logic

IS FIN6 Now The First RANSOMWARE GROUP?

In its latest FIN6 report, FireEye found this change in tactics from Trinity to Ryuk / LockerGoga.

However, analysts of the company could not be sure if this is the main modus operandi of this group now, or if this is just a side activity carried out by some group members “independent of the Group’s payment card violations.” But whether or not FIN6 is now the first ransomware group, companies and their departments of cybersecurity need to be carefully aware of this new development, read the recital.


Continue Reading
0
87 Views


Vulnerability
Phishing is a worse nightmare of security than ransomware or hacking
Moseley (Raam) Posted On April 3, 2019


The phishing attacks just don’t stop, more disturbing as ransomware, malware or hacking.

The biggest safety hairstrain for business and the hardest to deal with phishing and fake emails. According to the UK Government’s 2019 Cyber Security Breaches Survey, phishing attacks, whether through fraudulent e-mails or directed to fake Web sites, are the most common type of cyberattack.

Phishing emails –where assailants pose like trusted colleagues or other contacts, it is easy to send and difficult to fight the wrong ones. Much of the most important violations of data over the past few years –from the Sony Photos attack, the DNC hacking, to various attacks on banks all began with phishing emails.

“Protection against such violations or attacks requires both technical controls and good personnel awareness, including non-specialist staff that is typically targets of phishing assaults,” the report said.

Cyber security breaches 2019 Sophisticated; technical attacks like the denial of service are relatively less frequent in the report, as was the case in previous years. It also stated that there has been a decline in the number of organizations that complain of viruses, spyware or other malware attacks which suggest that such activities are less common or less visible, although it notes that denials are more likely to impact communications and education firms as well as large companies in general.

In addition to the most common attacks, phishing was also considered to be the worst violations or attacks. Where an infringement has resulted in data or assets loss, since 2018, the average costs for a cyber-attack on a company have increased to £4,180 by over £ 1,000, a report found.

Spam

The report also found that, as in previous years, employees were more likely to detect the most disruptive violation or attack than the use of cyber security software. For 63% of companies and 70% of charities, employees, contractors or volunteers reported the most disturbing breaches directly. It may also suggest companies that under-spend cybersecurity greatly; the Report says that there are wild variations in how many companies spend on the issue of security, though analysts warn that only about 2% of IT budgets go towards security.

“It shows the importance of staff vigilance as well as technological checks for the early determination of infringement.” While a typical organization will probably only suffer a few breaches per year, the report says many more will be experienced. This indicates, in addition to the overall decrease in the number of attacks reported, that the attackers change their approach.

“Attackers may target fewer enterprises, but they may attack these more or more often,” he warned. In the last 12 months, 32% of UK enterprises reported an attack on cyber security, down from 43% in the previous year. While less companies report violations because they are safer, the report also points out that other reasons exist.

Although they are less secure. One possibility, as mentioned, is that attackers will change their behavior with more attacks aimed at a smaller range of companies. This may explain why the number of companies identifying violations has fallen, but the number of attacks reported by firms identifying them has been increasing.

Alternatively, the General Data Protection Regulation (GDPR) might be introduced in May 2018. “GDPR may have changed what companies regard as a violation, or it may have made some companies less prepared to accept cyber security breaches,” he notes.


Continue Reading
0
80 Views


Cyber Attack
Police Federation attacked by ransomware
Moseley (Raam) Posted On March 21, 2019

Police attack

Police association says that databases and servers hit “malware attack that encrypted data.”

The England and Wales Police Federation (PFEW) has suffered an apparent ransomware attack which has an impact on what is described as its databases and servers.

The Surrey office of the police staff association, which accounts for more than 119,000 police officers, was the victim of a cyberattack on March 9th. The PFEW’s statement says “immediate steps” have been taken to isolate the event, with a number of systems taken offline to minimize the propagation of “malware attacks that encrypted data.”

The ransomware attack encrypted several databases and servers and prevented access to data and email services. The national PFEW member database, the case management system and the conference and hotel reservation system were affected. The attack also removed backup information.

“Many of our systems have been affected and we are working closely with cyber experts to restore systems and to determine how much of the data has not been available,” the Federation of Police stated.

The database in question contains information about the PFEW members, and although at present there is no evidence that the data have also been stolen during the attack, the federation says it “could not be discounted” and that people who could be affected will be contacted.

“Our priority was to mitigate the damage from the attack and protect our members’ and others ‘ personal data whose information we hold,” he added. The PFEW brought forensic experts from BAE Systems to support the attack.

The incident was reported to the National Cyber Security Centre, the Commissioner of Information and the National Crime Agency, and an investigation is under way.

“The National Crime Agency conducts an investigation and a wider law enforcement action into the cyber incident affecting the English and Wales Police Federations,” said the NCA. “NCA National Cyber Crime Unit (NCCU) specialists manage on-going investigations. They are working with the PFEW and the National Cyber Security Center (NCSC) to better understand the incident.

“We know about cyber incidents affecting the English and the Wales Police Federation and work with the NCSC organization.”

Those affected are recommended to be vigilant about suspicious e-mails, texts and telephone calls,” they said. The Police Federation has established a website and a helpline for all members concerned.


Continue Reading
0
125 Views


Cyber Attack
The attack against Israeli users by Ransomware fails miserably because of coding errors
Moseley (Raam) Posted On March 5, 2019

Ransomware Attack

Hackers failed to trigger the download of ransomware because of a code error, but still succeeded in defacing thousands of websites. 

On Saturday, Hackers launched a failed cyber-attack attempting to ransomware infect millions of Israelis.


According to current proof, the attack was carried out by hackers operating from Palestine.


The incident took place on Saturday 2 March, when hackers successfully poisoned Nagich’s DNS records, a web service that provides an accessibility (a11y) widget embedded in thousands of Israel’s web sites for people with reading impairments to gain access.


According to reports by Israeli cyber security experts, hackers automatically embed malicious code on thousands of Israeli websites using Nagich widgets. The code would default the site with a message saying’ #OpJerusalem, Jerusalem is Palestine’ and would then initiate an automatic download for a Windows file named’ flashplayer install.exe,’ which is a file tainted with ransomware.


But for the hackers, things didn’t go as planned. While the defacement message was displayed on thousands of web pages, including some of Israel’s major news sites, the file was not downloaded at all. Researchers only found the code to trigger the file download during the analysis of defacement messages. They said that a coding error prevented any auto-download operation. The error was that malicious code stop after the defacement and not trigger the ransomware download if your OS version is a new string than “Windows.”

The error was that there are no “Windows” user agent strings alone, since browser user agent strings also include the Windows version number, such as “Windows XP” or “Windows 10.” The file that was to be downloaded to users ‘ systems was, according to a analysis by CyberArk, a non-described ransomware strain, which would have encrypted files if users ever ran it.

The attack on Nagich lasted only a few hours on Saturday and the service recovered access to its DNS records and stopped delivery by the end of the day of the malicious code.


Continue Reading
0
185 Views


Cyber Attack
Ransomware was abandoned in favor of cryptojacking attacks on the company
Moseley (Raam) Posted On February 26, 2019

Cryptojacking attack

As defenses improve, criminals seek ways to secure a return to their illegal schemes.

Ransomware is becoming popular as cyber attackers look for other ways to earn a criminal living from compromising enterprise companies, with cryptojacking now capturing these people’s interests worldwide.

Ransomware is a virulent malware form. Variants such as WannaCry, CryptoMix, GandCrab and Ryuk can encrypt infected systems and disks, remove content barriers and prevent proper operation of PCs. To make a profit from these malware infections, hackers demand payment-usually in cryptocurrency-in exchange for a key that can or cannot decrypt infected systems.

We have seen the catastrophic effect that ransomware can have on companies around the world in recent years.
However, now alert to the financial and operational damage that this malware can cause, organizations protect themselves more effectively against ransomware, and cyber security companies constantly develop software to provide free alternatives to ransomware – infected systems.

These changes have distanced cybercriminals from ransomware to easier alternatives that can still make a profit.

On Tuesday, IBM Security’s research team released the 2019 IBM X – Force Threat Intelligence Index, which says there are two major shifts in today’s cyber – criminal world – the shift away from ransomware and a reduced reliance on malware in general in direct attacks.

According to the report, the use of ransomware against the company has been “significantly reduced,” with only one major spam – based ransomware attack recorded by IBM throughout 2018 through the Necurs botnet.

In total, ransomware attacks in Q4 2018 decreased by 45 percent compared to Q1 2018, while cryptojacking attempts quadrupled by 450 percent in the same time frame.

If we look at the decline in malware use, the shift away from ransomware, and the rise in targeted campaigns, all these trends tell us that return-on-investment is a real motivating factor for cyber criminals, “said Wendi Whitmore, Director of IBM X-Force Threat Intelligence.”[…] Personally identifiable information (PII) has begun to lose its value, and new illicit profit models are beginning to lose their value. This led to the secret hijack of corporate networks and consumer devices for these digital currencies.

In addition, the report found that the abuse of system tools to attack the company has increased rather than malware. IBM says more than half of cyberattacks-57 percent-in 2018 leveraged common applications such as PowerShell and PsExec, but malware remained popular in advanced persistent threat groups (APT).

In cyber security, the misconfiguration of public – facing systems, such as the use of default credentials or exposed databases, is also still a problem for companies. According to IBM, misconfiguration incidents reported by the public have increased by 20 percent year – on – year.


Continue Reading
0
204 Views


Cyber Attack
A New B0r0nt0K Ransomware Infects Linux Servers demends for 20 bitcoin to access website
Moseley (Raam) Posted On February 25, 2019

Ransomware

A new ransomware called B0r0nt0 K encrypts the websites of the victim and demands a ransom of 20 bitcoins or about $ 75,000. This ransomware is known to infect Linux servers, but users running Windows can also be encrypted.

This encrypted website was running on Ubuntu 16.04 and all its files were encrypted, renamed and attached to them by the.rontok extension.

Since a sample of the ransomware was not found, there is little other information than what we learned from the files submitted and the payment site. If B0r0nt0 K encrypts a file, it will base64 the encrypted data as shown below, according to Michael Gillespie.

The name of the file will also be renamed by encrypting the file name, encoding it by base64, encoding it by url and finally adding the extension to the file name.rontok. An example of the name of an encrypted file is zmAAwbbilFw69b7ag4G4bQ%3D%3D.rontok

Base64 Encoded Encrypted File

Although the user could not provide a ransom note, he could provide the payment site’s URL at https / borontok.uk. The user will be asked to submit his personal identification when visiting this site.

Once an ID is entered, the user will receive a payment page that includes the amount of the bitcoin ransom, the bitcoin payment address and the email info@botontok.uk that can be used to contact the developers. The ransom demand in this particular case was 20 bitcoins, which is currently about $75,000. However, the developers seem willing to negotiate the price.

payment-information

Also, anyone can see the hacker embedded comment “Vietnamese Hacker” when examining the source code for the payment site. Although this may indicate that the developer is Vietnamese, it is by no means proof.

B0r0nt0k

Image credit: Bleeping Computers


Continue Reading
0
221 Views


Malware
New Ransomware (Gandcrab) and Stealer Combo in The Wild – Steals & Encrypt Sensitive Data
Moseley (Raam) Posted On January 7, 2019


A new malware chain that uses multiple payloads to steal confidential data from the machine of the victim and encrypt their files with GandCrab Ransomware

Threat actors using the Fallout exploit kit, a toolkit designed to exploit ports, software vulnerabilities and deploy backdoors in vulnerable systems.

Malwarebytes security researchers observed a threat actor using the Fallout exploit kit to distribute GandCrab ransomware to the Vidar information stealer and secondary payload.

Vidar_GandCrab

Credit : MalwareBytes

The malware identified as Vidar has the ability to steal and can be customized according to the requirements of the threat actors.

Researchers noted that Vidar is available for sale, a single license costs $700, along with usual credit card numbers and passwords, including the ability to steal digital wallets passwords.

Vidar_product

Credit : MalwareBytes

When the vidar is executed on the client machine, it searches for the data specified in the profile configuration and sends the data back to the C2 server immediately via an unencrypted HTTP POST request.

The following system details are stolen, including specs, running processes, installed applications, IP address, country, city and ISP address. It then saves the data to the.txt file and sends it back to the attacker.

Vidar loads the secondary payload via its control and control server after extracting the information from the client machine.

“In about a minute after the initial Vidar infection, the files of the victim are encrypted and their wallpaper is hijacked to display the GandCrab version 5.04 note.”


Continue Reading
0
267 Views


Malware
Malwarebytes Fileless Ransomware: An emerging threat to the United States
Moseley (Raam) Posted On December 28, 2018

Malwarebytes ransomware

A new report on malware bytes examines Sorebrect, a fileless threat to ransomware detected in the US. Together with three other fileless attacks this year.

According to a new Malwarebytes report, a completely fileless ransomware known as Sorebrect is “one of the first of its kind “to combine traditional ransom functionality with fileless tactics.

In ” Under the Radar: The Future of Undetected Malware, ” Malwarebytes detailed four fileless attacks, including Emotet, TrickBot, SamSam and Sorebrect, observed throughout 2018. The report referred to a study by the Ponemon Institute that states that ” fileless malware attacks are estimated to account for 35 percent of all attacks in 2018 and are nearly 10 times more likely to succeed than file – based attacks. ” For example, Malwarebytes stated that ” Emotet malware was detected and removed more than 1.5 million times using Malwarebytes between January and September 2018. ”

While Emotet was found to be most active in the United States, an increase in activity was also seen globally in counties such as the United Kingdom, the Philippines and Canada.

One of the biggest targets in the United States Texas was for Emotet. Adam Kujawa, Malware Intelligence Director at Malwarebytes, based in Santa Clara, California, said that he believes this is because Texas has a large population, a number of military bases and a growing technology industry.

Sorebrect has also gone to the United States. It was first seen in the Middle East in 2017 that the networks of mainly manufacturing companies were infected. But Malwarebytes said that in several states, including Missouri and Tennessee, the fileless ransomware was found this year. “For us, this threat has not been very widespread and we have not yet seen any copycats of this feature making large splashes, ” the report said.”

However, it’s just a matter of time before someone perfects this infection method and computer use becomes a bigger risk. ” Kujawa said Sorebrect combines traditional ransom features with fileless tactics and network share targets. ” Right now, the most popular ransomware, GandCrab, has all sorts of abilities. The fact is, however, that[ Sorebrect] is a new development of ransomware, something we haven’t seen before. And in the near future it is almost certain to be copied, ” said Kujawa. ” The main form of infection in fileless malware is either exploited by an exploit script or exploited by a malicious Office document. In any case, it allows the ransomware to stay in memory without putting anything on the disk and hanging for as long as it wants until it wants to start encrypting things.”

The risk of Sorebrect poses becomes clearer, as it does not need a person to start it. Although its delivery mechanism is not fully known, Kujawa said that fileless ransomware is believed to be partially distributed through exploit kits and malicious spam campaigns.

“When it’s on the system, what usually happens to any kind of fileless malware is that it finds a way to resist. Otherwise it’s gone once you leave it with your computer, “said Kujawa. ” So, they will create malformed registry entries or keys in many cases and have code in them. And every time the computer reboots, the code reaches out, picks up the malware and reinfects the system.

With Sorebrect, since it can encrypt everything, I imagine that it probably becomes known after the initial infection and once it begins to encrypt. “In order to protect against threats such as fileless ransomware, the report recommends that companies extend their current protection beyond signature – based malware detection and behavioral detection.

In addition, Malwarebytes suggested that companies focus more on blocking threat delivery mechanisms, especially e – mail messages, and using self – defense security products that can prevent malware from disabling or removing it from a system.


Continue Reading
0
289 Views