The ransomware (or cyber extortion) threat is on the rise. In 2020, there was a spike in the number of reported incidents and the number of hackers attempting to extort money from organizations. It is important that every organization does all it can to combat these criminals and being informed is a key element. In this article we see the most dangerous ransomware of 2020.

2020 is drawing to a close and perhaps it is not surprising, given the world situation, that there has been a significant spike in ransomware attacks, especially in the first quarter. In that period, according to some sources, it peaked at 25% compared to the previous quarter.

The most dangerous ransomware

Maze

According to an FBI consultant for the private sector, “Unknown cyber actors have targeted several US and international companies with the Maze ransomware since early 2019. Maze encrypts data on an infected computer’s file system and its shares of network file. Once the victim has been compromised, but before the encryption event, the actors extract the data. “

“After the encryption event, the cybercriminals demand a specific ransom for the victim paid in Bitcoin (BTC) to obtain the decryption key. An international Maze campaign targeted the healthcare sector while its deployment in the United States it was more varied “.

The FBI first observed Maze ransomware activity against US victims in November 2019. Since its initial observation, Maze has used several methods for intrusion, including creating cryptocurrency-looking sites. malicious and malspam campaigns impersonating government agencies and well-known security providers. It is certainly among the most dangerous and insidious ransomware and has done a lot of damage in the last year.

REvil ransomware

You may have heard of REvil Ransomware due to a recent breach by media and entertainment lawyers Grubman Shire Meiselas & Sacks. They confirmed the news that their studio was the victim of a ransomware attack. The attack took place in early 2020.

Several prominent celebrities, clients of the law firm, have potentially suffered a data leak. Madonna’s tour contract has allegedly been leaked.

The attackers doubled the ransom note to $42 million and threatened to release malicious information about President Trump.

SNAKE (EKANS) Ransomware

Ekans Ransomware is a variant of the malware that infects industrial control systems to interrupt operations until a ransom is paid. Security analysts say Ekans is a spin-off of Snake Ransomware and that it has so far infected factories related to the automotive and electronics sectors, particularly Honda.

Hackers reportedly targeted Honda servers with a variant of file encryption malware called Ekans, forcing company authorities to send manufacturing unit workers home when automated devices were installed they have become inoperative.

While Honda has never admitted that its servers were down due to a cyber attack, it has admitted that its IT infrastructure was down for some reason.

This ransomware is particularly dangerous for companies that may have to stop production due to the attack.

Trickbot Ransomware – the danger in a petition

A phishing email campaign asking you to vote anonymously on the Black Lives Matter campaign is spreading information-stealing TrickBot malware. Born as a banking Trojan, the TrickBot has evolved to perform a variety of malicious behaviors.

This behavior includes side spreading across a network, theft of credentials saved in browsers, theft of Active Directory Services databases, theft of OpenSSH cookies and keys, theft of RDP, VNC and PuTTY Credentials, and more. TrickBot also works with ransomware operators, such as Ryuk, to give access to a compromised network to distribute the ransomware.

Mailto (known as Netwalker Ransomware)

NetWalker hit the scene in mid-2009. Similar to other well-supported ransomware families, operators target global high-value entities. The group’s objectives span several industries and also encompass the education, medical and government sectors.

NetWalker collects data from its targets and is used by operators as leverage through threats to publish or release data in case the victim fails to meet their demands. To date, the stolen data belonging to twelve different NetWalker victims has been publicly disclosed. The attackers behind NetWalker campaigns are known to use common utilities, post-exploitation toolkits, and Living-off-the-Land (LOTL) tactics to explore a compromised environment and steal as much data as possible. These tools can include mimikatz (and their variants), various PSTools, AnyDesk, TeamViewer, NLBrute, and more.

In recent months, NetWalker has seen the transition to a RaaS (Ransomware as a Service) delivery model, which will potentially open the platform to a growing number of enterprising criminals. More recently, we have seen NetWalker spam campaigns using COVID-19-related bait to lure victims into initiating the infection.

Conclusions

Ransomware are particularly subtle and dangerous attacks, which not only aim to collect data, but leverage the dynamics of a ransom.

SOD, through the Acronis Cyber Protect Cloud service, can defend data from this type of attack. Protection takes place by analyzing user behavior and identifying suspicious transactions. The intervention in case of attack is immediate and allows to recover, in most cases, the attacked data.

Thanks to a backup system, blocking the data encryption action and behavior analysis, Acronis Cyber Protect is an excellent service against the most dangerous ransomware attacks, capable of detecting suspicious behaviors before they become really dangerous for data.

Useful links: