Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ryuk Malware. Show all posts
Ryuk Ransomware
malware Ransomware Ryuk Malware Ryuk Ransomware

Ryuk Ransomware Making Comeback with New Tools and Techniques

 

Ryuk ransomware has gained immense popularity in the notorious sphere of cybercrime by 2019. It has been on a rise both in terms of its reach and complexity as it goes about demanding ransoms worth multi-million-dollars from large organizations, local governments, and healthcare institutions. 
 
In one of their latest development, the operators of the malware have configured it to deploy a Trojan named ‘BazarLoader’ which is operated by the same threat group that is behind Trickbot. However, BazarLoader Trojan is equipped with advanced techniques to evade detection; the potential for long term infection in BazarLoader hints towards a change that the operators have brought in Ryuk’s plan of action. 
 
Ryuk is well-planned and targeted ransomware that is being operated since 2018 by WIZARD SPIDER, a Russia-based operator of the TrickBot banking malware, and the criminals behind this ransomware largely focus on big companies in order to acquire an exorbitant amount in ransom. 
 
After gaining access, Ryuk is programmed to permeate network servers as files are exchanged between systems. The malware is circulated via malicious email attachments and once it gathers all the important data from a given network, it lets the authors of Ryuk Ransomware acquire administrator credentials and gain access to the harvested data from the network, the malware does so by opening a shell back to the actors operating the threat. 
 
It takes only 29 hours to successfully carry out a complete attack on the network it is targeting; the process entails the entire series of incidents beginning from the spam mail to the successful encryption of data, as per the findings of DFIR. 
 
Threat actors behind ransomware attacks are rapidly evolving their attack vectors as the count of Ransomware attacks surge up to 365 percent over the past year. Owing to its ever-expanding operations, Ryuk made it to the notorious list of ransomware gangs having their own data leak websites wherein they release the data of companies who refuse to pay the demanded amount. 
 
The malware is continually changing itself to become more and more sophisticated, leaving companies with no option but to pay the extortionate amounts. The threat has expanded its reach beyond just private organizations and has also been recorded to target National services’ computers.
Read more »
Ryuk Malware
Cyberattack Ransomware Ransomware Attacks. Ryuk Malware

Durham City, North Carolina Hit by Ransomware Attack



On Friday, The City of Durham, North Carolina suffered a cyberattack wherein Ryuk Ransomware crippled the city's IT systems and compromised its public safety phone networks. According to media reports, the city first experienced a phishing attack that eventually allowed the Ryuk Ransomware to develop onto its IT systems. In an immediate response, Durham shut down its network to prevent the attack from further spreading onto the entire network. All-access to the DCI Network for the Durham Police Department, the Durham Sheriff’s Office and their communications center had been temporarily disabled. Ryuk is well-planned and targeted ransomware that is being operated since 2018 by WIZARD SPIDER, a Russia-based operator of the TrickBot banking malware. After gaining access, Ryuk is programmed to permeate network servers as files are exchanged between systems.

As of now, there are no traces of data being stolen, however, users are advised to stay wary of phishing emails acting to be from the city officials. Alongside this, the attack led to the shut down of Durham's 911 call center and caused its Fire Department to be deprived of phone service. Ryuk's technical capabilities are relatively low, however, it has successfully targeted various small to large organizations across the world and encrypted hundreds of systems, storage, and data centres. Usually, the malware corrupt networks after they have been infected by the TrickBot Trojan, a malware designed to illegally harvest users' private data via phishing.

The malware is circulated via malicious email attachments and once it gathers all the important data from a given network, it lets the authors of Ryuk Ransomware acquire administrator credentials and gain access to the harvested data from the network, the malware does so by opening a shell back to the actors operating the threat.

"According to the SBI, the ransomware, named Ryuk, was started by a Russian hacker group and finds its way into a network once someone opens a malicious email attachment. Once it's inside, Ryuk can spread across network servers through file shares to individual computers," WRAL reported.

As per the findings that followed the investigations initiated by the city, the malware employed in the attack was found to be having Russian origins, however, the exact origin of the attack still remains unknown and the investigation regarding the same is underway.
Read more »
Tribune Publishing
Cyber Security Ransomware Ryuk Malware Tribune Publishing

A Malware Program That Hobbled Newspapers Nationwide Makes a Comeback


Ryuk Malware has made a rebound once more and this time it focused on the Tribune publishing Newspaper operations. The Malware program, a refined curve on an extortionate exemplary, is believed to have been utilized in an attack that has maimed newspapers across the nation.

The Malware is such that it automatically spreads from one computer to another, enciphering essential documents en route with an unbreakable code. Endeavors to gain access to the enciphered information, and the malware displays a ransom note, to deposit bitcoin into an unidentified wallet and receive a  key to decode the user's entire system , the refusal for which will result in the documents remaining 'locked for good'.

The issue notwithstanding, surfaced near midnight Thursday and spread quickly over the next day, when sports editors at the Union-Tribune attempted to transmit the completed pages to the printing office. Thusly hindering the distribution of the Saturday editions of The Times and Union-Tribune papers in Florida, Chicago and Connecticut, as well as the West Coast editions of the Wall Street Journal along with the New York Times.

Ryuk showed up on the radar of cybersecurity specialists in August, when the security scientists MalwareHunterTeam rumored five unfortunate casualties. An investigation with Check Point Research was published soon thereafter, assessing that it had officially gotten the attackers more than $640,000, and that much of its code coordinated with that of a ransomware program called Hermes, which has been connected with the North Korean hacking group that was behind the famous WannaCry attack.

Ben Herzog, a security specialist with Check Point says that Ryuk is different as it is a relatively  'artisanal' malware, used to target explicit organizations with little resilience for disturbance, such like hospitals and other healing facilities, ports and now obviously, the newspapers.

Despite the fact that their analysis till now has not prevailed with regards to determining if Ryuk had a technique for consequently spreading among a system or not, which Itay Cohen, another security analyst with Check Point, said may specify "prior, manual work that was done by the attackers in order to take these networks as a hostage.”

Read more »
Subscribe to: Posts (Atom)