Last Week in Ransomware: Week of June 28th

Ransomware in the News

If you’re a small or medium business using locally hosted cloud storage drives by a popular brand you need to disconnect them from the internet immediately. Due to a flaw hackers have been able to delete all the contents of the hard drives remotely. And now attackers are try to monetize it with ransomware. 

But the previously mentioned company isn’t alone in its security woes, yet another hard drive manufacturer got hit with Ragnar Locker. The attackers then subsequently released over 700 GB of data on the darknet.

Last week we mentioned that a number of suspected Clop ransomware gang members got arrested. It turns out that the Binance cryptocurrency exchange was instrumental in helping track them down. The arrest certainly put a hamper on the group, but it wasn’t a fatal blow. After a short break, the group has released yet more confidential data.

In other news, it seems that yet another American city has been hit with ransomware this time by the Conti group who leaked approximately 18,000 files mostly consisting of police citations.

A new cybersecurity coalition has formed called #RansomAware. Their goal is to encourage organizations to report ransomware attacks as soon as they can.

In yet another attack on healthcare institutions, a Brazilian medical company got hit with Sodinokibi, more commonly known as REvil.

Ransomware Research

When any ransomware becomes successful enough they’re always copycats, this time the APIS ransomware has a pretender that’s really a wiper. 

A new strain of Rapid ransomware is making the rounds and using the .snoopdog extension along the way. Meanwhile, the Dharma ransomware has gone with .ZEUS or .nmc and STOP is using .ddsg. And not to be left out, there’s a new ransomware on stage called Spyro.

GitHub Tools 

Raccine is an open-source tool that attempts to be the ransomware vaccine working on the hypothesis that ransomware likes to delete Shadow copies using vssadmin. The program is able to intercept that request and kill the invoking process. Unfortunately, it does mean that legitimate processes can’t use that same command but it’s worth looking into and potentially another layer of defense for your system.

NekRos is a slightly older ransomware generator for Windows. Use at your own risk, but it could be a useful tool in testing your own defenses.

Upcoming Security Conferences

The Cyber Strategy Retreat 2021(July 14-15)

The Cyber Strategy Retreat aims to facilitate collaboration between business, technology, and Risk Management leadership. The retreat focuses on going above and beyond compliance-driven programs and tackling cybersecurity risks, such as ransomware, to the fullest extent possible.

International Conference on Cyber Security 2021 (July 19 – 22)

The International Conference on Cybersecurity or ICCS is hosted by the FBI and Fordham University and focuses on bringing together government, private sector, and academia to discuss current cyber threats such as ransomware. 

BLACK HAT USA 2021 (July 31 – Aug 5)

Black hat is one of the largest annual security conferences. It’s the corporate version of Defcon and as such is a great opportunity to get face time with security professionals such as the Varonis team. Be sure to stop by our booth!