The Week in Ransomware – September 23rd 2022 – LockBit leak
This week we saw some embarrassment for the LockBit ransomware operation when their programmer leaked a ransomware builder for the LockBit 3.0 encryptor.
Running the ransomware builder is simple and quickly creates an encryptor, private/public encryption keys, and a decryptor by just running a batch file.
The LockBit 3.0 ransomware builder makes it easy for any would-be threat actor to roll out their own operation simply by modifying the enclosed configuration file to use custom ransom notes.
Other research this week shows how the BlackMatter ransomware gang continues to evolve its operation by upgrading its data exfiltration tool for double-extortion attacks.
Also Read: April 2022 PDPC Incidents and Undertaking
Contributors and those who provided new ransomware information and stories this week include: @struppigel, @DanielGallagher, @demonslay335, @malwrhunterteam, @Seifreed, @malwareforme, @fwosar, @BleepinComputer, @FourOctets, @billtoulas, @jorntvdw, @PolarToffee, @Ionut_Ilascu, @VK_Intel, @LawrenceAbrams, @serghei, @S2W_Official, @GeeksCyber, @BroadcomSW, @pcrisk, @3xp0rtblog, @vxunderground, @PogoWasRight, @AhnLab_SecuInfo, and @zscaler.
September 17th 2022
Empress EMS (Emergency Medical Services), a New York-based emergency response and ambulance service provider, has disclosed a data breach that exposed customer information.
September 19th 2022
PCrisk found new STOP ransomware variants that append the .aawt, .aabn, .aamv, and .aayu extension.
PCrisk found a new Phobos ransomware variant that appends the .duck extension and drops a ransom note named info.txt and info.hta.
PCrisk found a new VoidCrypt ransomware variant that appends the .Joker extension and drops a ransom note named Decryption-Guide.txt and Decryption-Guide.HTA.
PCrisk found a new VSOP ransomware variant that appends the .minex extension and drops a ransom note named readme.txt.
September 20th 2022
The Hive ransomware operation claimed responsibility for an attack on the New York Racing Association (NYRA), which previously disclosed that a cyber attack on June 30, 2022, impacted IT operations and website availability and compromised member data.
PCrisk found a ransomware called BlackBit that appends the .BlackBit extension and drops a ransom notes named Restore-My-Files.txt and info.hta.
September 21st 2022
The LockBit ransomware operation has suffered a breach, with an allegedly disgruntled developer leaking the builder for the gang’s newest encryptor.
The threat actor using Crytox ransomware has been active since at least 2020, but has received significantly less attention than many other ransomware families. In September 2021, the Netherlands-based company RTL publicly acknowledged that they were compromised by the threat actor. The company paid Crytox 8,500 euros. Compared with current ransom demands, this amount is relatively low. Unlike most ransomware groups, the Crytox threat actor does not perform double extortion attacks where data is both encrypted and held for ransom.
September 22nd 2022
The BlackCat ransomware (aka ALPHV) isn’t showing any signs of slowing down, and the latest example of its evolution is a new version of the gang’s data exfiltration tool used for double-extortion attacks.
Build.bat creates an RSA public/private key pair by executing Keygen.exe, and Builder.exe that generates a LockBit 3.0 ransomware using the generated key pair.
This is our analysis of the LockBit 3.0 builder that was leaked online on September 21, 2022.
MalwareHunterTeam found a few ransomware samples pretending to be GTA 6 source code.
PCrisk found a new Zeppelin ransomware variant that appends the .ORCA extension and drops the HOW_TO_RECOVER_DATA.hta ransom note.
September 23rd 2022
PCrisk found new STOP ransomware variants that append the .ofoq, .ofww, and .oflg extension.
The ASEC analysis team is constantly monitoring malware distributed to vulnerable MS-SQL servers. The analysis team has recently discovered the distribution of FARGO ransomware that is targeting vulnerable MS-SQL servers. Along with GlobeImposter, FARGO is one of the prominent ransomware that targets vulnerable MS-SQL servers. In the past, it was also called the Mallox because it used the file extension .mallox.