Ransomware this week (12th March, 2021)
Past two weeks evidence the dominance of the cyber-security news about Microsoft Exchange Server ProxyLogon vulnerabilities.
Gilliespie, cyber security researcher, noted that these vulnerabilities were exploited by DearCry ransomware developers to target the Microsoft Exchange Servers.
If you are using Microsoft Exchange server, you should take OWA or the patch the server. In addition to this, perform an offline backup of the server so as to avoid being encrypted, if compromised.
Other big news of the week is the REvil ransomware operators planning on DooS victims and calling the business partners belong to them to force vicitms into paying the demanded sum.
And, there are several new ransomware attacks against organizations including Molson Coors and the Spanish government.
6th March 2021
REvil gangs to call victim’s business partners to pay ransom
The ransomware operation announced this week. The threat actors are using DDoS attacks and voice calls to journalists and victims’ business partners to generate ransom fee.
Jessy ransomware in the wild
The malware is discovered by Jakub Kroustek. This discovery adds yet another variant of Dharma ransomware. It appends .Jessy extension to the filenames of the encrypted files.
7th March 2021
New ROG Dharma virus
The credit of this discovery goes to Jakub Kroustek. This Dharma variant appends .ROG extension to the encrypted files.
8th March 2021
New Sarbloh ransomware showing support to Indian farmer’s protest
A new Sarbloh ransomware encrypts stored files and soon drops a ransom note. The ransom message shows support for the protest of Indian farmers.
Cyber attack at Flagstar Bank
The US bank and mortgage lender suffered a data breach, results in their customers and employees’ data exposure. It was discovered that CLOP ransomware developers hacked their Accelion file transfer server in January.
New Martix ransomware variant
Dnwls0719 discovered a new Matrix ransomware variant that appends .JDPR extension. It shows ransom note in JDPR_README.rtf.
9th March 2021
Arrest of a South Korean for phishing attacks
The attacker is suspected to be a member of GandCrab Ransomware, using Phishing emails to infect victims.
Bad Gopher ransomware in the wild
S!Ri discovered this ransomware. The malware appends the filenames of the encrypted files using .gopher extension.
10th March 2021
Ransomware attack on 700 Spanish government labor agency officers
SEPE systems belong to the Spanish government agency for labor were taken down after attacked by Ryuk ransomware. The attack hit more than 700 agency offices of Spain.
New STOP ransomware variant
Michael Gillespie a DJVU/STOP variant that encrypts stored files using .reig and .tirp extensions to encrypt files.
Darkside ransomware 2.0
Hackers on Russian-speaking hacker forum announced about this release. 3xport was the first to observe this.
11th March 2021
Cyber attack on Molson Coors
Molson Coors, beverage company, has suffered a cyber attack as a result of which there is significant distruption to their business operations.
A new ransomware infiltrates through Microsoft Exchange Servers’ ProxyLogon vulnerabilities exploit
DearCry is the ransomware. After hacking into Microsoft Exchange Servers using the recently disclosed ProxyLogon vulnerabilities, the threat actors belong ensure the virus installation.
Michael Gillespie was the first to observe this the newly DearCry ransomware was targeting the exchange servers.
New Dharma ransomware variants
Jakub Kroustek discovered new Dharma ransomware variants that append .biden, .eofyd and .duk extensions.
12th March 2021
New Dharma ransomware variant
Jakub Kroustek found new Dharma ransomware variants that append .LAO and .Pirat extensions.
