Connect with us

Business

The Week in Ransomware – September 3rd 2021 – Targeting Exchange

Published

on

Over the past two weeks, it has been busy with ransomware news ranging from a gang shutting down and releasing a master decryption key to threat actors turning to Microsoft Exchange exploits to breach networks.

The biggest news is the Ragnarok ransomware operation shutting down and releasing a master decryptor on their site. Using the released keys, Emsisoft was able to create its own decryptor.

We have also seen ransomware gangs, such as LockFile and Conti, begin to use the recently disclosed Microsoft Exchange ProxyShell vulnerabilities.

The FBI and CISA have also been busy, releasing advisories warning of ransomware attacks over holiday weekendsgangs targeting food and agriculture organizationsinformation about the 1% group, and IOCs for the Hive Ransomware.https://www.ad-sandbox.com/static/html/sandbox.html

A threat actor released the complete source code for the Babuk Ransomware, allowing any wannabe threat actor to start their own ransomware operation. Unfortunately, this leak will lead to many threat actors worldwide creating their own Ransomware-as-a-Service.

Finally, leaked Conti training material and a Pysa data exfiltration script have given us insight into how ransomware gangs conduct their attacks and what data they are targeting.

Contributors and those who provided new ransomware information and stories this week include: @VK_Intel@fwosar@struppigel@malwrhunterteam@PolarToffee@Ionut_Ilascu@BleepinComputer@demonslay335@LawrenceAbrams@jorntvdw@FourOctets@DanielGallagher@Seifreed@serghei@malwareforme@vxunderground@AltShiftPrtScn@thepacketrat@TalosSecurity@GossiTheDog@pcrisk@fbgwls245@ddd1ms, and @darktracer_int.

August 21st 2021

Microsoft Exchange servers being hacked by new LockFile ransomware

A new ransomware gang known as LockFile encrypts Windows domains after hacking into Microsoft Exchange servers using the recently disclosed ProxyShell vulnerabilities.

August 23rd 2021

FBI: OnePercent Group Ransomware targeted US orgs since Nov 2020

The Federal Bureau of Investigation (FBI) has shared info about a threat actor known as OnePercent Group that has been actively targeting US organizations in ransomware attacks since at least November 2020.

Nokia subsidiary discloses data breach after Conti ransomware attack

SAC Wireless, a US-based Nokia subsidiary, has disclosed a data breach following a ransomware attack where Conti operators were able to successfully breach its network, steal data, and encrypt systems.

New STOP ransomware variant

PCRisk found a new STOP ransomware variant that appends the .orkf extension.

New Dharma ransomware variant

PCRisk found a new Dharma ransomware variant that appends the .dts extension.

August 24th 2021

Ransomware gang’s script shows exactly the files they’re after

A PowerShell script used by the Pysa ransomware operation gives us a sneak peek at the types of data they attempt to steal during a cyberattack.

New BlackKingdom ransomware variant

dnwls0719 found a BlackKingdom variant that appends the .svyx extension.

Black Kingdom

August 26th 2021

Ragnarok ransomware releases master decryptor after shutdown

Ragnarok ransomware gang appears to have called it quits and released the master key that can decrypt files locked with their malware.

FBI shares technical details for Hive ransomware

The Federal Bureau of Investigation (FBI) has released some technical details and indicators of compromise associated with Hive ransomware attacks.

New Dharma ransomware variants

PCRisk found new Dharma ransomware variants that appends the .6ix9 and .TCYO extensions.

New Phobos ransomware variant

PCRisk found a new Phobos ransomware variant that appends the .PERDAK extension.

August 27th 2021

Boston Public Library discloses cyberattack, system-wide technical outage

The Boston Public Library (BPL) has disclosed today that its network was hit by a cyberattack on Wednesday, leading to a system-wide technical outage.

New Dharma ransomware variant

PCRisk found a new Dharma ransomware variant that appends the .RZA extension.

New HQ_52_42 ransomware

dnwls0719 found a new ransomware called HQ_52_42 that appends the .HQ_52_42 extension.

HQ_52_42

August 28th 2021

New SanwaiWare 2021 ransomware

dnwls0719 found a new ransomware called SanwaiWare 2021 that appends the .sanwai extension.

SanwaiWare 2021

August 30th 2021

New STOP ransomware variant

PCRisk found a new STOP ransomware variant that appends the .lqqw extension.

New Loki Locker ransomware

dnwls0719 found a new ransomware called Loki Locker that appends the .Loki extension.

Loki Locker

August 31st 2021

FBI, CISA: Ransomware attack risk increases on holidays, weekends

The FBI and CISA urged organizations not to let down their defenses against ransomware attacks during weekends or holidays in a joint cybersecurity advisory issued earlier today.

September 1st 2021

LockBit gang leaks Bangkok Airways data, hits Accenture customers

Bangkok Airways, a major airline company in Thailand, confirmed it was the victim of a cyberattack earlier this month that compromised personal data of passengers.

BlackMatter x Babuk : Using the same web server for sharing leaked files

In this post, we mentioned the fact of BlackMatter and Babuk using the same web server for sharing the leaked files.

September 2nd 2021

Translated Conti ransomware playbook gives insight into attacks

Almost a month after a disgruntled Conti affiliate leaked the gang’s attack playbook, security researchers shared a translated variant that clarifies any misinterpretation caused by automated translation.

FBI warns of ransomware gangs targeting food, agriculture orgs

The FBI says ransomware gangs are actively targeting and disrupting the operations of organizations in the food and agriculture sector, causing financial loss and directly affecting the food supply chain.

September 3rd 2021

Conti ransomware now hacking Exchange servers with ProxyShell exploits

The Conti ransomware gang is hacking into Microsoft Exchange servers and breaching corporate networks using recently disclosed ProxyShell vulnerability exploits.

Babuk ransomware’s full source code leaked on hacker forum

A threat actor has leaked the complete source code for the Babuk ransomware on a Russian-speaking hacking forum.

Babuk, BlackMatter, and Groove share the same data leak site

DarkTracer found that all three ransomware groups are utilizing the same Tor data leak site. They are not believed to be affiliated, other than possible being part of the same cartel.

Mount Locker, Astro Team, and XING Locker share same Tor site

DarkTracer found that Astro Team, Mount Locker, and XING Locker are sharing the same Tor network infrastructure. Astro Team and MountLocker are believed to be affiliated with each other.

Get ready for new ransomware variants based on Babuk

Dmitry Smilyanets noted that threat actors worldwide will likely launch their own ransomware operations based on the leaked Babuk ransomware source code.

New STOP ransomware variant

PCRisk found a new STOP ransomware variant that appends the .efdc extension.

Source: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-3rd-2021-targeting-exchange/

Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Copyright © 2023 Cyber Reports Cyber Security News All Rights Reserved Website by Top Search SEO