The Week In Ransomware – February 12th 2021 – More Keys Released
This week we saw another ransomware shut down its operation and a significant attack against Cyberpunk 2077 game developer CD Projekt Red.
Another operation known as Ziggy Ransomware shut down this week and released the decryption keys for victims. This shut down was due to increased concern about law enforcement action after the disruption and arrests in the Netwalker Ransomware operation.
We also saw a major attack against game developer CD Projekt Red from a ransomware group called HelloKitty. During this attack, the threat actors claimed to have stolen the alleged source code for the Witcher 3 and Cyberpunk 2077 games, which threat actors later put up for auction on a hacker forum.
Contributors and those who provided new ransomware information and stories this week include: @fwosar, @BleepinComputer, @jorntvdw, @DanielGallagher, @Seifreed, @serghei, @LawrenceAbrams, @malwrhunterteam, @demonslay335, @Ionut_Ilascu, @FourOctets, @malwareforme, @struppigel, @VK_Intel, @PolarToffee, @JakubKroustek, @M_Shahpasandi, @vxunderground, @BrettCallow, @chum1ng0, @Kangxiaopao. @Amigo_A_, @Intel_by_KELA, and @danusminimus.
Also Read: PDPA For Companies: Compliance Guide For Singapore Business
February 7th 2021
Ziggy ransomware shuts down and releases victims’ decryption keys
The Ziggy ransomware operation has shut down and released the victims’ decryption keys after concerns about recent law enforcement activity and guilt for encrypting victims.
Albany ransomware attack threatens criminal cases
The 2019 ransomware attack on the city’s servers is now potentially affecting criminal cases after it was revealed that the city police department lost all digital copies of its 2018 internal affairs files.
New DarkWorld ransomware
xiaopao found a new ransomware called DarkWorld that appends the .dark extension and drops a ransom note named import.txt.
New Tortoise ransomware
Danus found the new Tortoise Ransomware that appends the .tortoise extension but does not appear to actually encrypt anything.
February 8th 2021
New DaddyCrypt JCrypt variant
xiaopao found a new JCrypt ransomware variant that appends called DarkWorld that appends the .daddycrypt extension and drops a ransom note named _RECOVER__FILES__.daddycrypt.txt.
February 9th 2021
New Dharma ransomware variants
Jakub Kroustek found new Dharma ransomware variants that append the .wcg, .con30, and .text extensions to encrypted files.
CD PROJEKT RED gaming studio hit by ransomware attack
CD PROJEKT RED, the video game development studio behind Cyberpunk 2077 and The Witcher trilogy, has disclosed a ransomware attack that impacted its network.
HelloKitty ransomware behind CD Projekt Red cyberattack, data theft
The ransomware attack against CD Projekt Red was conducted by a ransomware group that goes by the name ‘HelloKitty,’ and yes, that’s the name the threat actors utilize.
New Matrix ransomware variant
xiaopao found a new Matrix ransomware variant that appends the .TRU8 extension.
February 10th 2021
French MNH health insurance company hit by RansomExx ransomware
French health insurance company Mutuelle Nationale des Hospitaliers (MNH) has suffered a ransomware attack that has severely disrupted the company’s operations. BleepingComputer has learned.
Hackers auction alleged stolen Cyberpunk 2077, Witcher source code
Threat actors are auctioning the alleged source code for CD Projekt Red games, including Witcher 3, Thronebreaker, and Cyberpunk 2077, that they state were stolen in a ransomware attack.
New Dharma ransomware variants
Jakub Kroustek found new Dharma ransomware variants that append the .word, and .LOTUS extensions to encrypted files.
New STOP Djvu variant
Michael Gillespie found a new STOP DJvu ransomware variant that appends the .ygkz extension to encrypted files.
New Android ransomware
MalwareHunterTeam found a new Android ransomware targeting users from Kazakhstan.
February 11th 2021
Avaddon ransomware fixes flaw allowing free decryption
The Avaddon ransomware gang has fixed a bug that let victims recover their files without paying the ransom. The flaw came to light after a security researcher exploited it to create a decryptor.
February 12th 2021
Seraing: the City hit by a cyber attack!
Last weekend, the city of Seraing reported that its services were temporarily inaccessible to the public and for a reason beyond its control. Indeed, since the computer network of the city of Seraing was the victim of a malicious attack! A complaint has been filed.
Also Read: 10 Government Data Leaks in Singapore: Prevent Cybersecurity
The Trigano company victim of a cyberattack, the Tournon-sur-Rhône plant shut down
The manufacturer of caravans, motorhomes, camping furniture and mobile homes was the victim of a cyberattack on Tuesday February 9. It prevents access to computers. The factory based in Tournon-sur-Rhône (Ardèche) is therefore at a standstill this Friday, February 12.
0 Comments