Governments struck again this week towards members of ransomware operations, imposing sanctions on one risk actor and sentencing one other to jail.
On Tuesday, the Australian, US, and UK governments introduced sanctions towards Aleksandr Gennadievich Ermakov, a Russian nationwide believed to be chargeable for the 2022 Medibank hack and a member of the REvil ransomware group.
In a report by Intel471, we be taught that Ermakov had in depth involvement in cybercrime, together with as a ransomware operator and affiliate. The risk actor can be believed to be concerned in each authentic and legal software program improvement.
On Thursday, the US authorities additionally sentenced Russian nationwide Vladimir Dunaev to 5 years and 4 months in jail for serving to to create and distribute the TrickBot malware and dealing with ransomware operations.
“Dunaev was a malware developer for the Trickbot Group, overseeing the creation of web browser injection, machine identification, and knowledge harvesting codes utilized by the Trickbot malware,” reads the criticism towards Dunaev and his co-conspirators.
The DOJ press launch additionally states that Dunaev additionally developed ransomware and helped deploy it to assault American hospitals, colleges, and companies within the USA.
Sadly, we additionally realized about quite a few large-scale assaults this week, together with an Akira assault on Tietoevry, an assault on water companies large Veolia North America, and an assault on fintech agency Equilend, which LockBit claimed.
loanDepot additionally shared extra details about the affect of its January sixth ransomware assault, stating that it uncovered the information of 16.6 million individuals.
Contributors and those that supplied new ransomware data and tales this week embrace: @billtoulas, @LawrenceAbrams, @serghei, @BleepinComputer, @Seifreed, @Ionut_Ilascu, @demonslay335, @fwosar, @malwrhunterteam, @NCSC, @TrendMicro, @Intrinsec, @Fortinet, @pcrisk, and @rivitna2.
January twentieth 2024
Researchers hyperlink 3AM ransomware to Conti, Royal cybercrime gangs
Safety researchers analyzing the exercise of the just lately emerged 3AM ransomware operation uncovered shut connections with notorious teams, such because the Conti syndicate and the Royal ransomware gang.
January twenty first 2024
Tietoevry ransomware assault causes outages for Swedish companies, cities
Finnish IT companies and enterprise cloud internet hosting supplier Tietoevry has suffered an Akira ransomware assault impacting cloud internet hosting clients in certainly one of its knowledge facilities in Sweden.
January twenty second 2024
loanDepot cyberattack causes knowledge breach for 16.6 million individuals
Mortgage lender loanDepot says that roughly 16.6 million individuals had their private data stolen in a ransomware assault disclosed earlier this month.
Cactus Ransomware technical evaluation
On January twentieth the Cactus ransomware group attacked various victims throughout various industries. The assaults had been disclosed on their leak website with the accompanying sufferer knowledge. The ransomware group has routinely put stress on victims by releasing private details about workers of the sufferer group; this has included drivers licenses, passports, photos and different private identification.
New Phobos ransomware variant
PCrisk discovered a brand new Phobos ransomware variant that appends the .gotmydatafast extension.
New Frivinho Ransomware
PCrisk discovered a brand new ransomware that appends the .Frivinho0 extension and drops a ransom word named PLS_READ_ME.txt.
New Chaos Ransomware variant
PCrisk discovered a brand new ransomware that appends the .backoff extension and drops a ransom word named read_it.txt.
January twenty third 2024
Water companies large Veolia North America hit by ransomware assault
Veolia North America, a subsidiary of transnational conglomerate Veolia, disclosed a ransomware assault that impacted methods a part of its Municipal Water division and disrupted its invoice cost methods.
Kasseika ransomware makes use of antivirus driver to kill different antiviruses
A just lately uncovered ransomware operation named ‘Kasseika’ has joined the membership of risk actors that employs Deliver Your Personal Susceptible Driver (BYOVD) ways to disable antivirus software program earlier than encrypting information.
US, UK, Australia sanction REvil hacker behind Medibank knowledge breach
The Australian, US, and UK governments have introduced sanctions for Aleksandr Gennadievich Ermakov, a Russian nationwide thought-about chargeable for the 2022 Medibank hack and a member of the REvil ransomware group.
Menace Evaluation: BianLian
Unit 42 researchers have been monitoring the BianLian ransomware group, which has been within the prime 10 of probably the most energetic teams primarily based on leak website knowledge we’ve gathered. From that leak website knowledge, we’ve primarily noticed exercise affecting the healthcare and manufacturing sectors and industries, and impacting organizations primarily in the USA (US) and Europe (EU).
January twenty fourth 2024
UK says AI will empower ransomware over the subsequent two years
The UK’s Nationwide Cyber Safety Centre (NCSC) warns that synthetic intelligence (AI) instruments may have an antagonistic near-term affect on cybersecurity, serving to escalate the specter of ransomware.
International fintech agency EquiLend offline after latest cyberattack
New York-based world monetary expertise agency EquiLend says its operations have been disrupted after some methods had been taken offline in a Monday cyberattack.
Medibank’s Attacker: IT Businessman, Claimed Psychologist and Alleged Cybercriminal
Ermakov’s id was uncovered by the Australian Indicators Directorate (ASD) and the Australian Federal Police (AFP). In line with a Jan. 23, 2024, unique interview with Australia’s Channel 9, ASD Appearing Director-Common Abi Bradshaw mentioned the investigation met useless ends at instances. However the ASD drew on assist from different 5 Eyes intelligence companions (the NSA, FBI and GCHQ within the U.Okay.) in addition to knowledge from personal trade together with Microsoft, which wrote about its function right here. Bradshaw says Microsoft’s knowledge strengthened the federal government’s confidence in Ermakov’s real-world identification.
New Phobos ransomware variant
PCrisk discovered a brand new Phobos ransomware variant that appends the .rdptest extension.
New LockXX ransomware
rivitna discovered the brand new LockXX ransomware that appends the .lockxx extension and drops a ransom word named lockxx.recovery_data.hta.
January twenty fifth 2024
Russian TrickBot malware dev sentenced to 64 months in jail
Russian nationwide Vladimir Dunaev has been sentenced to 5 years and 4 months in jail for his function in creating and distributing the Trickbot malware utilized in assaults towards hospitals, corporations, and people worldwide.
One other Phobos Ransomware Variant Launches Assault – FAUST
Not too long ago, FortiGuard Labs uncovered an Workplace doc containing a VBA script geared toward propagating the FAUST ransomware, one other variant of Phobos. The attackers utilized the Gitea service to retailer a number of information encoded in Base64, every carrying a malicious binary. When these information are injected right into a system’s reminiscence, they provoke a file encryption assault. Determine 1 reveals the assault chain.
January twenty sixth 2024
Ransomware Roundup – Albabat
This version of the Ransomware Roundup covers the Albabat ransomware.
New STOP ransomware variants
PCrisk discovered new STOP ransomware variants that append the .cdcc and .cdxx extensions.
That is it for this week! Hope everybody has a pleasant weekend!
