Ransomware in the News
If you’re a small or medium business using locally hosted cloud storage drives by a popular brand you need to disconnect them from the internet immediately. Due to a flaw hackers have been able to delete all the contents of the hard drives remotely. And now attackers are try to monetize it with ransomware.
But the previously mentioned company isn’t alone in its security woes, yet another hard drive manufacturer got hit with Ragnar Locker. The attackers then subsequently released over 700 GB of data on the darknet.
Want to learn ransomware basics and earn a CPE credit? Try our free course.
Last week we mentioned that a number of suspected Clop ransomware gang members got arrested. It turns out that the Binance cryptocurrency exchange was instrumental in helping track them down. The arrest certainly put a hamper on the group, but it wasn’t a fatal blow. After a short break, the group has released yet more confidential data.
A new cybersecurity coalition has formed called #RansomAware. Their goal is to encourage organizations to report ransomware attacks as soon as they can.
In yet another attack on healthcare institutions, a Brazilian medical company got hit with Sodinokibi, more commonly known as REvil.
When any ransomware becomes successful enough they’re always copycats, this time the APIS ransomware has a pretender that’s really a wiper.
A new strain of Rapid ransomware is making the rounds and using the .snoopdog extension along the way. Meanwhile, the Dharma ransomware has gone with .ZEUS or .nmc and STOP is using .ddsg. And not to be left out, there’s a new ransomware on stage called Spyro.
Raccine is an open-source tool that attempts to be the ransomware vaccine working on the hypothesis that ransomware likes to delete Shadow copies using vssadmin. The program is able to intercept that request and kill the invoking process. Unfortunately, it does mean that legitimate processes can’t use that same command but it’s worth looking into and potentially another layer of defense for your system.
NekRos is a slightly older ransomware generator for Windows. Use at your own risk, but it could be a useful tool in testing your own defenses.
Upcoming Security Conferences
The Cyber Strategy Retreat aims to facilitate collaboration between business, technology, and Risk Management leadership. The retreat focuses on going above and beyond compliance-driven programs and tackling cybersecurity risks, such as ransomware, to the fullest extent possible.
The International Conference on Cybersecurity or ICCS is hosted by the FBI and Fordham University and focuses on bringing together government, private sector, and academia to discuss current cyber threats such as ransomware.
Black hat is one of the largest annual security conferences. It’s the corporate version of Defcon and as such is a great opportunity to get face time with security professionals such as the Varonis team. Be sure to stop by our booth!
Michael Raymond is a security researcher and video producer for the Null Byte and SecurityFWD YouTube Channels.