[ad_1]
It has been fairly a busy week with ransomware, with legislation enforcement making arrests, data-wiping assaults, and the return of the Qlocker ransomware.
This week’s largest information is Russia’s arrest of fourteen suspected members of the REvil ransomware operation. As well as, a senior Biden administration official mentioned that one of many fourteen suspects is accountable for the Colonial Pipeline ransomware assault.
Europol additionally performed a legislation enforcement operation towards VPNLab, a platform generally utilized by ransomware gangs. Regulation enforcement operatives seized 15 servers utilized by the VPNLab.web service and took down its most important web site, making the platform not obtainable.
Whereas it was a superb week for legislation enforcement, sadly, new assaults have been found.
Microsoft disclosed assaults on Ukrainian organizations utilizing data-wiping malware disguised as ransomware. This malware is called “WhisperGate,” and has been attributed by Ukrainian officers as being performed by, or on the behest, of the Russian authorities.
For customers and small companies, we noticed the unlucky return of Qlocker, infamous ransomware that encrypted hundreds of QNAP NAS gadgets final 12 months.
Lastly, in analysis launched by safety firms we realized that White Rabbit ransomware is linked to FIN8 hackers, new evaluation of the BlackCat/ArchV and Avaddon ransomware operations, and the FBI linking Diavol to the TrickBot Group.
Contributors and people who supplied new ransomware info and tales this week embrace: @serghei, @VK_Intel, @billtoulas, @struppigel, @Ionut_Ilascu, @malwareforme, @jorntvdw, @Seifreed, @FourOctets, @PolarToffee, @DanielGallagher, @malwrhunterteam, @fwosar, @LawrenceAbrams, @BleepinComputer, @demonslay335, @fbgwls245, @Amigo_A_,@JakubKroustek, @pcrisk, @TrendMicro, @LabsSentinel, @MsftSecIntel, @Mandiant, and @GrujaRS.
January fifteenth 2022
Qlocker ransomware returns to focus on QNAP NAS gadgets worldwide
Risk actors behind the Qlocker ransomware are as soon as once more concentrating on Web-exposed QNAP Community Hooked up Storage (NAS) gadgets worldwide.
Russia prices 8 suspected REvil ransomware gang members
Eight members of the REvil ransomware operation which were detained by Russian officers are at present dealing with legal prices for his or her criminality.
January sixteenth 2022
Microsoft: Faux ransomware targets Ukraine in data-wiping assaults
Microsoft is warning of damaging data-wiping malware disguised as ransomware being utilized in assaults towards a number of organizations in Ukraine.
January seventeenth 2022
New STOP ransomware variants
PCrisk discovered two new STOP ransomware variants that append the .vfgj and .fhkf extensions.
New Chaos Ransomware variant
dnwls0719 discovered a brand new Chaos ransomware variant that appends the .AZ extension.
January 18th 2022
New White Rabbit ransomware linked to FIN8 hacking group
A brand new ransomware household known as ‘White Rabbit’ appeared within the wild not too long ago, and in keeping with current analysis findings, may very well be a side-operation of the FIN8 hacking group.
Trend big Moncler confirms information breach after ransomware assault
Italian luxurious style big Moncler confirmed that they suffered a knowledge breach after recordsdata have been stolen by the AlphV/BlackCat ransomware operation in December and revealed at the moment on the darkish net.
Europol shuts down VPN service utilized by ransomware teams
Regulation enforcement authorities from 10 international locations took down VPNLab.web, a VPN service supplier utilized by ransomware operators and malware actors.
BlackCat Ransomware | Extremely-Configurable, Rust-Pushed RaaS On The Prowl For Victims
BlackCat (aka AlphaVM, AlphaV) is a newly established RaaS (Ransomware as a Service) with payloads written in Rust. Whereas BlackCat shouldn’t be the primary ransomware written within the Rust language, it joins a small (but rising) sliver of the malware panorama making use of this common cross-platform language.
New Dharma Ransomware variant
dnwls0719 discovered a brand new Dharma ransomware variant that appends the .MTX extension.
January nineteenth 2022
Advertising and marketing big RRD confirms information theft in Conti ransomware assault
RR Donnelly has confirmed that menace actors stole information in a December cyberattack, confirmed by BleepingComputer to be a Conti ransomware assault.
One Supply to Rule Them All: Chasing AVADDON Ransomware
This weblog publish explores exercise, similarities and overlaps between a number of ransomware households associated to AVADDON ransomware, serving as a case examine to know how ransomware operators assume and proceed to show a revenue in a continually evolving cybercrime ecosystem.
New Dharma ransomware variant
PCrisk discovered a brand new Dharma ransomware variant that appends the .cip extension.
January twentieth 2022
FBI hyperlinks Diavol ransomware to the TrickBot cybercrime group
The FBI has formally linked the Diavol ransomware operation to the TrickBot Group, the malware builders behind the infamous TrickBot banking trojan.
New STOP Ransomware variant
Jakub Kroustek discovered a brand new STOP ransomware variant that appends the .maak extension.
New Lure ransomware found
Amigo-A noticed the brand new Lure ransomware that appends the .entice extension and drops a ransom word named RESTORE.txt.
New Makop ransomware variant
GrujaRS discovered a brand new Makop ransomware variant that appends the .factfull extension.
January twenty first 2022
New Phobos ransomware variant
PCrisk discovered a brand new Phobos ransomware variant that appends the .ELBOW extension.
That is it for this week! Hope everybody has a pleasant weekend!
[ad_2]
