I Ransomware più pericolosi Giacomo Lanzi

The most dangerous Ransomware in 2020

The ransomware (or cyber extortion) threat is on the rise. In 2020, there was a spike in the number of reported incidents and the number of hackers attempting to extort money from organizations. It is important that every organization does all it can to combat these criminals and being informed is a key element. In this article we see the most dangerous ransomware of 2020.

2020 is drawing to a close and perhaps it is not surprising, given the world situation, that there has been a significant spike in ransomware attacks, especially in the first quarter. In that period, according to some sources, it peaked at 25% compared to the previous quarter.

The most dangerous ransomware

Maze

According to an FBI consultant for the private sector, “Unknown cyber actors have targeted several US and international companies with the Maze ransomware since early 2019. Maze encrypts data on an infected computer’s file system and its shares of network file. Once the victim has been compromised, but before the encryption event, the actors extract the data. “

“After the encryption event, the cybercriminals demand a specific ransom for the victim paid in Bitcoin (BTC) to obtain the decryption key. An international Maze campaign targeted the healthcare sector while its deployment in the United States it was more varied “.

The FBI first observed Maze ransomware activity against US victims in November 2019. Since its initial observation, Maze has used several methods for intrusion, including creating cryptocurrency-looking sites. malicious and malspam campaigns impersonating government agencies and well-known security providers. It is certainly among the most dangerous and insidious ransomware and has done a lot of damage in the last year.

REvil ransomware

You may have heard of REvil Ransomware due to a recent breach by media and entertainment lawyers Grubman Shire Meiselas & Sacks. They confirmed the news that their studio was the victim of a ransomware attack. The attack took place in early 2020.

Several prominent celebrities, clients of the law firm, have potentially suffered a data leak. Madonna’s tour contract has allegedly been leaked.

The attackers doubled the ransom note to $42 million and threatened to release malicious information about President Trump.

SNAKE (EKANS) Ransomware

Ekans Ransomware is a variant of the malware that infects industrial control systems to interrupt operations until a ransom is paid. Security analysts say Ekans is a spin-off of Snake Ransomware and that it has so far infected factories related to the automotive and electronics sectors, particularly Honda.

Hackers reportedly targeted Honda servers with a variant of file encryption malware called Ekans, forcing company authorities to send manufacturing unit workers home when automated devices were installed they have become inoperative.

While Honda has never admitted that its servers were down due to a cyber attack, it has admitted that its IT infrastructure was down for some reason.

This ransomware is particularly dangerous for companies that may have to stop production due to the attack.

Trickbot Ransomware – the danger in a petition

A phishing email campaign asking you to vote anonymously on the Black Lives Matter campaign is spreading information-stealing TrickBot malware. Born as a banking Trojan, the TrickBot has evolved to perform a variety of malicious behaviors.

This behavior includes side spreading across a network, theft of credentials saved in browsers, theft of Active Directory Services databases, theft of OpenSSH cookies and keys, theft of RDP, VNC and PuTTY Credentials, and more. TrickBot also works with ransomware operators, such as Ryuk, to give access to a compromised network to distribute the ransomware.

Mailto (known as Netwalker Ransomware)

NetWalker hit the scene in mid-2009. Similar to other well-supported ransomware families, operators target global high-value entities. The group’s objectives span several industries and also encompass the education, medical and government sectors.

NetWalker collects data from its targets and is used by operators as leverage through threats to publish or release data in case the victim fails to meet their demands. To date, the stolen data belonging to twelve different NetWalker victims has been publicly disclosed. The attackers behind NetWalker campaigns are known to use common utilities, post-exploitation toolkits, and Living-off-the-Land (LOTL) tactics to explore a compromised environment and steal as much data as possible. These tools can include mimikatz (and their variants), various PSTools, AnyDesk, TeamViewer, NLBrute, and more.

In recent months, NetWalker has seen the transition to a RaaS (Ransomware as a Service) delivery model, which will potentially open the platform to a growing number of enterprising criminals. More recently, we have seen NetWalker spam campaigns using COVID-19-related bait to lure victims into initiating the infection.

Conclusions

Ransomware are particularly subtle and dangerous attacks, which not only aim to collect data, but leverage the dynamics of a ransom.

SOD, through the Acronis Cyber Protect Cloud service, can defend data from this type of attack. Protection takes place by analyzing user behavior and identifying suspicious transactions. The intervention in case of attack is immediate and allows to recover, in most cases, the attacked data.

Thanks to a backup system, blocking the data encryption action and behavior analysis, Acronis Cyber Protect is an excellent service against the most dangerous ransomware attacks, capable of detecting suspicious behaviors before they become really dangerous for data.

Useful links:

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 June 16, 2024
    Posted by Andrey Stoykov on Jun 15# Exploit Title: Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 # Date: 6/2024 # Exploit Author: Andrey Stoykov # Version: 1.9.0.6 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html Description - It was found that the application suffers from business logic flaw - Additionally the application is vulnerable […]
  • APPLE-SA-06-10-2024-1 visionOS 1.2 June 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Jun 11APPLE-SA-06-10-2024-1 visionOS 1.2 visionOS 1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT214108. Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. CoreMedia Available for: Apple Vision Pro Impact: An app may be […]
  • CyberDanube Security Research 20240604-0 | Multiple Vulnerabilities in utnserver Pro/ProMAX/INU-100 June 9, 2024
    Posted by Thomas Weber via Fulldisclosure on Jun 09CyberDanube Security Research 20240604-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| SEH utnserver Pro/ProMAX / INU-100 vulnerable version| 20.1.22 fixed version| 20.1.28 CVE number| CVE-2024-5420, CVE-2024-5421, CVE-2024-5422 impact| High homepage| https://www.seh-technology.com/...
  • SEC Consult SA-20240606-0 :: Multiple critical vulnerabilities in Kiuwan SAST on-premise (KOP) & cloud/SaaS & Kiuwan Local Analyzer (KLA) June 9, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 09SEC Consult Vulnerability Lab Security Advisory < 20240606-0 > ======================================================================= title: Multiple critical vulnerabilities product: Kiuwan SAST on-premise (KOP) & cloud/SaaS Kiuwan Local Analyzer (KLA) vulnerable version: Kiuwan SAST
  • Blind SQL Injection - fengofficev3.11.1.2 June 9, 2024
    Posted by Andrey Stoykov on Jun 09# Exploit Title: FengOffice - Blind SQL Injection # Date: 06/2024 # Exploit Author: Andrey Stoykov # Version: 3.11.1.2 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.html Steps to Reproduce: 1. Login to application 2. Click on "Workspaces" 3. Copy full URL 4. Paste the HTTP GET request into […]
  • Trojan.Win32.DarkGateLoader (multi variants) / Arbitrary Code Execution June 9, 2024
    Posted by malvuln on Jun 09Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/afe012ed0d96abfe869b9e26ea375824.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Trojan.Win32.DarkGateLoader (multi variants) Vulnerability: Arbitrary Code Execution Description: Multiple variants of this malware look for and execute x32-bit "urlmon.dll" PE file in its current directory. Therefore, we can...
  • SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) June 9, 2024
    Posted by InfoSec-DB via Fulldisclosure on Jun 09Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) Google Dork: inurl:"Powered by Boelter Blue" Date: 2024-06-04 Exploit Author: CBKB (DeadlyData, R4d1x) Vendor Homepage: https://www.boelterblue.com Software Link: https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US Version: 1.3 Tested on: Linux Debian 9 (stretch), Apache 2.4.25, MySQL >= 5.0.12 CVE:...
  • CyberDanube Security Research 20240528-0 | Multiple Vulnerabilities in ORing IAP-420 May 30, 2024
    Posted by Thomas Weber via Fulldisclosure on May 29CyberDanube Security Research 20240528-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| ORing IAP-420 vulnerable version| 2.01e fixed version| - CVE number| CVE-2024-5410, CVE-2024-5411 impact| High homepage| https://oringnet.com/ found| 2024-01-19 by| T. Weber...
  • HNS-2024-06 - HN Security Advisory - Multiple vulnerabilities in Eclipse ThreadX May 30, 2024
    Posted by Marco Ivaldi on May 29Hi, Please find attached a security advisory that describes multiple vulnerabilities we discovered in Eclipse ThreadX (aka Azure RTOS). * Title: Multiple vulnerabilities in Eclipse ThreadX * OS: Eclipse ThreadX < 6.4.0 * Author: Marco Ivaldi * Date: 2024-05-28 * CVE IDs and severity: * CVE-2024-2214 - High - […]
  • SEC Consult SA-20240527-0 :: Multiple vulnerabilities in HAWKI didactic interface May 28, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 27 SEC Consult Vulnerability Lab Security Advisory < 20240527-0 > ======================================================================= title: Multiple vulnerabilities product: HAWKI (Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany) vulnerable version: 1.0.0-beta.1, versions before commit 146967f     fixed version: Github commit 146967f...

Customers

Newsletter

{subscription_form_1}