The Week In Ransomware – November 27th 2020 – Attacks Continue
With the USA holidays, this has been a relatively slow week in new research being released. We did, though, see some organizations get attacked or report historical attacks.
Last weekend, South Korean retail giant E-Land suffered a ransomware attack that forced them to close 23 retail stores while they recovered.
Contributors and those who provided new ransomware information and stories this week include: @demonslay335, @struppigel, @VK_Intel, @fwosar, @malwrhunterteam, @jorntvdw, @serghei, @Ionut_Ilascu, @FourOctets, @PolarToffee, @Seifreed, @DanielGallagher, @BleepinComputer, @LawrenceAbrams, @malwareforme, @TheDFIRReport, @LabsSentinel, @Emm_ADC_Soft, and @GrujaRS.
November 21st 2020
Ranzy ransomware emerged in September/October this year, and appears to be an evolution of ThunderX and, to a lesser extent, Ako ransomware. Ranzy shares many features and under-the-hood elements with its predecessors. However there have been a few key updates, including tweaks to encryption, methods of exfiltration, and the (now commonplace) use of a public “leak blog” to post victim data for those who do not comply with the ransom demand.
November 23rd 2020
South Korean conglomerate and retail giant E-Land has suffered a ransomware attack causing 23 of its retail stores to suspend operations while they deal with the attack.
Michael Gillespie found a new STOP Djvu Ransomware variant the appends the .lisp extension to encrypted files.
Over the course of 8 hours the PYSA/Mespinoza threat actors used Empire and Koadic as well as RDP to move laterally throughout the environment, grabbing credentials from as many systems as possible on the way to their objective. The threat actors took their time, looking for files and reviewing the backup server before executing ransomware on all systems. Hours after being ransomed, our files were opened from multiple Tor exit nodes, which confirms our suspicion that files had been exfiltrated.
Emmanuel_ADC-Soft found a new LolKek ransomware variant that appends the .xls extension to encrypted files.
November 25th 2020
French IT services giant Sopra Steria said today in an official statement that the October Ryuk ransomware attack will lead to a loss of between €40 million and €50 million.
Ritzau, the largest independent news agency in Denmark founded in 1866 by Erik Ritzau, said in a statement that it will not pay the ransom demanded by a ransomware gang that hit its network on Tuesday morning.
Baltimore County Public Schools has been hit today by a ransomware attack that led to a systemic shutdown of its network due to the number of systems impacted in the attack.
Egregor ransomware is an offshoot of the Sekhmet malware family that has been active since mid-September 2020. The ransomware operates by compromising organizations, stealing sensitive user data, encrypting said data, and demanding a ransom to exchange encrypted documents. Egregor is ransomware associated with the cyberattacks against GEFCO and Barnes & Noble, Ubisoft, and numerous others.
Network device manufacturer Belden was hit with a cyberattack that allowed threat actors to steal files containing information about employees and business partners.
GrujaRS found a new Vash Sorena variant that appends the .encrypt extension.
November 26th 2020
US Fertility, the largest network of fertility centers in the U.S., says that some of its systems were encrypted in a ransomware attack that affected the company two months ago, in September 2020.
Chicago-based transportation technology firm Rand McNally is working on restoring network functionality following a cyberattack that hit its systems earlier this week.
Canon has finally confirmed publicly that the cyberattack suffered in early August was caused by ransomware and that the hackers stole data from company servers.
November 27th 2020
French multinational production and distribution firm Banijay Group SAS was hit earlier this month by a DoppelPaymer ransomware attack and had sensitive information stolen by the ransomware operators during the incident.
That’s it for this week! Hope everyone has a nice weekend!
Privacy Ninja provides GUARANTEED quality and results for the following CORE SERVICES: