The most dangerous Ransomware in 2020
The ransomware (or cyber extortion) threat is on the rise. In 2020, there was a spike in the number of reported incidents and the number of hackers attempting to extort money from organizations. It is important that every organization does all it can to combat these criminals and being informed is a key element. In this article we see the most dangerous ransomware of 2020.
2020 is drawing to a close and perhaps it is not surprising, given the world situation, that there has been a significant spike in ransomware attacks, especially in the first quarter. In that period, according to some sources, it peaked at 25% compared to the previous quarter.
The most dangerous ransomware
According to an FBI consultant for the private sector, “Unknown cyber actors have targeted several US and international companies with the Maze ransomware since early 2019. Maze encrypts data on an infected computer’s file system and its shares of network file. Once the victim has been compromised, but before the encryption event, the actors extract the data. “
“After the encryption event, the cybercriminals demand a specific ransom for the victim paid in Bitcoin (BTC) to obtain the decryption key. An international Maze campaign targeted the healthcare sector while its deployment in the United States it was more varied “.
The FBI first observed Maze ransomware activity against US victims in November 2019. Since its initial observation, Maze has used several methods for intrusion, including creating cryptocurrency-looking sites. malicious and malspam campaigns impersonating government agencies and well-known security providers. It is certainly among the most dangerous and insidious ransomware and has done a lot of damage in the last year.
You may have heard of REvil Ransomware due to a recent breach by media and entertainment lawyers Grubman Shire Meiselas & Sacks. They confirmed the news that their studio was the victim of a ransomware attack. The attack took place in early 2020.
Several prominent celebrities, clients of the law firm, have potentially suffered a data leak. Madonna’s tour contract has allegedly been leaked.
The attackers doubled the ransom note to $42 million and threatened to release malicious information about President Trump.
SNAKE (EKANS) Ransomware
Ekans Ransomware is a variant of the malware that infects industrial control systems to interrupt operations until a ransom is paid. Security analysts say Ekans is a spin-off of Snake Ransomware and that it has so far infected factories related to the automotive and electronics sectors, particularly Honda.
Hackers reportedly targeted Honda servers with a variant of file encryption malware called Ekans, forcing company authorities to send manufacturing unit workers home when automated devices were installed they have become inoperative.
While Honda has never admitted that its servers were down due to a cyber attack, it has admitted that its IT infrastructure was down for some reason.
This ransomware is particularly dangerous for companies that may have to stop production due to the attack.
Trickbot Ransomware – the danger in a petition
A phishing email campaign asking you to vote anonymously on the Black Lives Matter campaign is spreading information-stealing TrickBot malware. Born as a banking Trojan, the TrickBot has evolved to perform a variety of malicious behaviors.
This behavior includes side spreading across a network, theft of credentials saved in browsers, theft of Active Directory Services databases, theft of OpenSSH cookies and keys, theft of RDP, VNC and PuTTY Credentials, and more. TrickBot also works with ransomware operators, such as Ryuk, to give access to a compromised network to distribute the ransomware.
Mailto (known as Netwalker Ransomware)
NetWalker hit the scene in mid-2009. Similar to other well-supported ransomware families, operators target global high-value entities. The group’s objectives span several industries and also encompass the education, medical and government sectors.
NetWalker collects data from its targets and is used by operators as leverage through threats to publish or release data in case the victim fails to meet their demands. To date, the stolen data belonging to twelve different NetWalker victims has been publicly disclosed. The attackers behind NetWalker campaigns are known to use common utilities, post-exploitation toolkits, and Living-off-the-Land (LOTL) tactics to explore a compromised environment and steal as much data as possible. These tools can include mimikatz (and their variants), various PSTools, AnyDesk, TeamViewer, NLBrute, and more.
In recent months, NetWalker has seen the transition to a RaaS (Ransomware as a Service) delivery model, which will potentially open the platform to a growing number of enterprising criminals. More recently, we have seen NetWalker spam campaigns using COVID-19-related bait to lure victims into initiating the infection.
Ransomware are particularly subtle and dangerous attacks, which not only aim to collect data, but leverage the dynamics of a ransom.
SOD, through the Acronis Cyber Protect Cloud service, can defend data from this type of attack. Protection takes place by analyzing user behavior and identifying suspicious transactions. The intervention in case of attack is immediate and allows to recover, in most cases, the attacked data.
Thanks to a backup system, blocking the data encryption action and behavior analysis, Acronis Cyber Protect is an excellent service against the most dangerous ransomware attacks, capable of detecting suspicious behaviors before they become really dangerous for data.
- Zero-Day attack: what they are and how to defend yourself with SOCaaS
- Monitoring system, an overview
- Data Exfiltration: defense against data theft
- Install a Let’s Encrypt certificate on Debian based machine
- WastedLocker: Next generation ransomware
- Protecting a site in WordPress: security package
- Critical ransomware: examples of successful attacks
- Secure Online Desktop Social Initiatives
- Backup as a Service (2)
- Cloud Conference (3)
- Cloud CRM (1)
- Cloud Server/VPS (20)
- Conferenza Cloud (4)
- ICT Monitoring (4)
- Log Management (2)
- News (16)
- ownCloud (4)
- Privacy (6)
- Secure Online Desktop (14)
- Security (6)
- Web Hosting (12)
- NSA Appoint Rob Joyce as Cyber Director January 15, 2021Joyce has long worked in US cybersecurity leadership, most recently serving as the NSA's top representative in the UK.
- Successful Malware Incidents Rise as Attackers Shift Tactics January 15, 2021As employees moved to working from home and on mobile devices, attackers followed them and focused on weekend attacks, a security firm says.
- How to Achieve Collaboration Tool Compliance January 15, 2021Organizations must fully understand the regulatory guidance on collaboration security and privacy so they can continue to implement and expand their use of tools such as Zoom and Teams.
- Name That Toon: Before I Go ... January 15, 2021Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
- These Kids Are All Right January 15, 2021
- Shifting Privacy Landscape, Disruptive Technologies Will Test Businesses January 14, 2021A new machine learning tool aims to mine privacy policies on behalf of users.
- 'Chimera' Threat Group Abuses Microsoft & Google Cloud Services January 14, 2021Researchers detail a new threat group targeting cloud services to achieve goals aligning with Chinese interests.
- Businesses Struggle with Cloud Availability as Attackers Take Aim January 14, 2021Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.
- NSA Recommends Using Only 'Designated' DNS Resolvers January 14, 2021Agency provides guidelines on securely deploying DNS over HTTPS, aka DoH.
- Who Is Responsible for Protecting Physical Security Systems From Cyberattacks? January 14, 2021It's a question that continues to engage debate, as the majority of new physical security devices being installed are now connected to a network. While this offers myriad benefits, it also raises the question: Who is responsible for their cybersecurity?
- SEC Consult SA-20210113-1 :: Multiple vulnerabilities in flatCore CMS January 13, 2021Posted by SEC Consult Vulnerability Lab on Jan 13SEC Consult Vulnerability Lab Security Advisory < 20210113-1 > ======================================================================= title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: < 2.0.0 Build 139 fixed version: Release 2.0.0 Build 139 CVE number: CVE-2021-23835, CVE-2021-23836, CVE-2021-23837, CVE-2021-23838 impact: High homepage:...
- SEC Consult SA-20210113-0 :: Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series January 13, 2021Posted by SEC Consult Vulnerability Lab on Jan 13SEC Consult Vulnerability Lab Security Advisory < 20210113-0 > ======================================================================= title: Multiple vulnerabilities product: Pepperl+Fuchs IO-Link Master Series See "Vulnerable / tested versions" vulnerable version: System 1.36 / Application 1.5.28 fixed version: System 1.52 / Application 1.6.11 CVE number:...
- Backdoor.Win32.Zombam.a / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6c5081e9b65a52963b0b1ae612ef7eb4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.a Vulnerability: Remote Stack Buffer Overflow Description: The malware listens on TCP port 80, sending an HTTP GET request with 300 or more bytes will trigger buffer overflow overwriting EIP. Type: […]
- Backdoor.Win32.Levelone.b / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/3f82e6ddc9f5242f5af200d2fbae4ce4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Levelone.b Vulnerability: Remote Stack Buffer Overflow Description: The backdoor listens on Port 7777, sending two large consecutive HTTP OPTIONS requests trigger the buffer overflow overwriting EIP. Type: PE32 MD5:...
- Backdoor.Win32.Levelone.a / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6a2d09c4527cf222e4e2571b074fcc0c.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Levelone.a Vulnerability: Remote Stack Buffer Overflow Description: The malware listens on Port 1500, sending a specially crafted HTTP TRACE request causes a buffer overflow and overwrites EIP with our payload. If […]
- Backdoor.Win32.Ketch.b / Remote Stack Buffer Overflow January 13, 2021Posted by malvuln on Jan 12Discovery / credits: malvuln - Malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/9d7be3799594a82bf7056905f501af03.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Ketch.b Vulnerability: Remote Stack Buffer Overflow Description: Makes HTTP GET request for a file "script.dat", and writes the server response to temporary file named "watchb.tmp" under c:\Windows dir. At 1032...
- Re: Backdoor.Win32.Xtreme.yvp / Insecure Permissions EoP January 13, 2021Posted by bo0od on Jan 12When you say backdoor, you mean backdoor which microsoft remotely using it or you mean a malware can take advantage of? malvuln:
- Advisory: ES2021-01 - Loopback access control bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address January 13, 2021Posted by Sandro Gauci on Jan 12# Loopback access control bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address - Fixed version: 4.5.2 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-01-coturn-access-control-bypass - Coturn Security Advisory: https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p - Other references: - CVE-2020-26262 -...
- Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability January 13, 2021Posted by Stefan Pietsch on Jan 12# Trovent Security Advisory 2010-01 # ##################################### Email address enumeration in reset password ########################################### Overview ######## Advisory ID: TRSA-2010-01 Advisory version: 1.1 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2010-01 Affected product: Web application Rocket.Chat Affected version:
- Envira Gallery - Lite Edition - Version 184.108.40.206 CVE-2020-35581 CVE-2020-35582 January 13, 2021Posted by Rodolfo Augusto do Nascimento Tavares on Jan 12==== [Tempest Security Intelligence - ADV-12/2020] ============================= Envira Gallery - Lite Edition - Version 220.127.116.11 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== [Table of Contents] ================================================ • Overview • Detailed description • Disclosure timeline • Acknowledgements • References ===== [Vulnerability Information]...
Tempo di lettura: 4 minLa pratica dello shadow IT e' l'utilizzo di sistemi informatici, dispositivi, software, appl… https://t.co/9wQPtvqemG
The practice of shadow IT is the use of computer systems, devices, software, applications and services without the… https://t.co/CgzjblglX9
Acronis Active Protection e' una tecnologia anti-ransomware avanzata. Protegge attivamente tutti i dati dei vostri… https://t.co/Hw7Rs2YOQa
Le insider threat sono difficili da individuare perche' provengono, appunto, dall'interno della vostra organizzazio… https://t.co/aborWoeBgK
Se il sito e' lento, stai perdendo clienti. E' molto semplice e non ci sono modi piu' gentili per dire la stessa co… https://t.co/yB18k0UH49