ransomedMalware
Last reported 10 days ago, by The Register (security)9 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1007System Service Discovery
“System Service Discovery”
- T1021.001Remote Desktop Protocol
“And another thing: If you spend $10000000000000 for machine learning security solutions but won’t invest $0.00 to close Remote Desktop Protocol (RDP) from the internet, I’m confused why you’re confused you got ransomed.”
- T1110Brute Force
“Next, Windows LUNA executed with no arguments uses a function called get_all_drives to brute-force the enumeration of all the available drives by going through the English alphabet and verifying if the drives are mapped to the machine using Rust library std::fs::read_dir.”
- T1486Data Encrypted for Impact
“Data Encrypted for Impact”
- T1543.003Windows Service
“See the Appendix: Windows Services Termination List for the complete list.”
- T1552.004Private Keys
“At this point, there are two sets of public/private keys: the authors and the malware’s.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Ransomware gets personal: 'We-know-where-you-are kind of stuff'“Some of these threats reported by ransomed organizations’ employees include: threatening texts, letters, or packages: 57 percent threats against family or friends: 37 percent physical intrusion: 19 percent abduction: 17 percent bodily harm: 13 percent stalking: 6 percent.”
-
How Businesses Should Be Scaling Their Security“Not doing so could be the difference between one or two machines having an initial payload to an entire site being ransomed.”
-
Defense Evasion: Defenders Strike Back!“…ity solutions but won’t invest $0.00 to close Remote Desktop Protocol (RDP) from the internet, I’m confused why you’re confused you got ransomed.”
-
Creating macOS Ransomware“In 2022, a reality we must come to terms with is that Macs can be hacked, ransomed and indeed get malware.”
-
LUNA Ransomware Attack Pattern Analysis“… are many differences between the two OS packages; it is probably more convenient to provide a single decryption tool for all endpoints ransomed, irrespective of the OS.”
-
What’s Your Backup Plan?“The entire system was ransomed.”
-
An Inside Look at Huntress’ Platform Vision and Mission“MSPs were constantly getting hacked and all of their clients were getting ransomed.”
-
Hackers Are Exploiting a Vulnerability in Billing Software“…ecure their applications and subject their unwitting customers to significant liability when sensitive data is inevitably leaked and/or ransomed.”
-
Understanding Your SMB Clients' Cybersecurity Needs“What would happen if you came in tomorrow and everything was encrypted/ransomed?”
Indicators in its reports
named in the reports above- servosity[.]comin 1 report
- process[.]pein 1 report
- 1cbbf108f44c8f4b…fbec2f83ab51in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.