Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

A Student Pirating Software Led To A Full-blown Ryuk Ransomware Attack

A Student Pirating Software Led To A Full-blown Ryuk Ransomware Attack

A student’s attempt to pirate an expensive data visualization software led to a full-blown Ryuk ransomware attack at a European biomolecular research institute.

BleepingComputer has long warned against software cracks, not only because they are illegal but because they are a common source of malware infections.

Threat actors commonly create fake software crack download sites, YouTube videos, and torrents to distribute malware, as shown below.

Fake crack site distributing ransomware

In the past, we have seen crack sites distribute ransomware, such as STOP and the Exorcist ransomware, cryptocurrency miners, and information-stealing trojans.

Also Read: 4 Best Practices On How To Use SkillsFuture Credit

Fake crack leads to a Ryuk ransomware attack

After the research institute suffered a Ryuk ransomware attack, Sophos’ Rapid Response team responded and neutralized the cyberattack.

This attack lost the institute a week’s worth of research data and a week-long network outage as servers were rebuilt from scratch and data restored from backups.

After performing forensics on the attack, Sophos determined that the initial point-of-entry for the threat actors was an RDP session using a student’s credentials.

The institute works with university students who assist in research and other tasks. As part of this cooperation, the institute provides the students with login credentials to log into their network remotely.

After gaining access to the student’s laptop and analyzing the browser history, they learned that the student had searched for an expensive data visualization software tool that they used at work and wanted to install on their home computer.

Instead of buying the license for a few hundred dollars, the student searched for a cracked version and downloaded it from a warez site.

However, instead of receiving the expected software, they were infected with an information-stealing trojan that logged keystrokes, stole the Windows clipboard history, and stole passwords, including the same credentials used by the Ryuk threat actors to log into the institute.

“It is unlikely that the operators behind the ‘pirated software’ malware are the same as the ones who launched the Ryuk attack,” said Peter Mackenzie, manager of Rapid Response at Sophos. “The underground market for previously compromised networks offering attackers easy initial access is thriving, so we believe that the malware operators sold their access on to another attacker. The RDP connection could have been the access brokers testing their access.”

Marketplaces devoted to the selling of remote access credentials have been flourishing over the last couple of years and have become a common source of accounts used by ransomware gangs to gain access to corporate networks.

Many of these stolen credentials are gathered using information-stealing trojans and then sold one by one on these marketplaces for as little as $3.

RDP servers currently sold on the UAS marketplace

Just recently, BleepingComputer was provided access to the leaked data for UAS, one of the largest Windows Remote Desktop credentials marketplaces.

This data showed that over the past three years, 1.3 million accounts were put up for sale on the UAS marketplace, providing a massive pool of victims for threat actors to target.

Also Read: 3 Reasons Why You Must Take A PDPA Singapore Course

Unfortunately, there will always be the potential for human error. Users will continue to open phishing emails and download software cracks no matter how much we tell them not to.

However, properly configuring security on the network, such as requiring MFA for Remote Desktop connections and restricting access from specific locations or IP addresses, would have prevented this attack.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us