While ransomware attacks continued throughout the week, for the most part, it has been quieter than usual, with only a few new variants released.
The biggest news was the attack on health care giant Scripps Health whose operations were severely impacted by a ransomware attack.
We also saw a new ransomware called N3TW0RM targeting Israeli companies using an interesting client-server encryption method.
Finally, we learned that Cuba Ransomware is now partnered with Hancitor to compromise and encrypt corporate networks more quickly.
Contributors and those who provided new ransomware information and stories this week include: @jorntvdw, @Ionut_Ilascu, @malwareforme, @LawrenceAbrams, @PolarToffee, @serghei, @demonslay335, @DanielGallagher, @malwrhunterteam, @FourOctets, @struppigel, @VK_Intel, @fwosar, @BleepinComputer, @Seifreed, @Intel_by_KELA, @AndreGironda, @GroupIB_GIB, @SophosLabs, @AltShiftPrtScn, @M0teki, @fbgwls245, @pcrisk, @chum1ng0, @PogoWasRight, @3xp0rtblog, @ProferoSec, @SecurityJoes, @cPeterr, and @y_advintel.
May 3rd 2021
Health care giant Scripps Health hit by ransomware attack
Nonprofit health care provider Scripps Health in San Diego is currently dealing with a ransomware attack that forced the organization to suspend user access to its online portal and switch to alternative methods for patient care operations.
N3TW0RM ransomware emerges in wave of cyberattacks in Israel
A new ransomware gang known as ‘N3TW0RM’ is targeting Israeli companies in a wave of cyberattacks starting last week.
New Nitro Ransomware variant
MalwareHunterTeam found a new Nitro Ransomware variant calling itself ‘ArchAngel Ransomware.’
New Galaxy Ransomware
Yelisey Boguslavskiy discovered that a new Galaxy Ransomware operation was getting ready to launch and would be stealing data from victims.
New Henry Ransomware
dnwls0719 found the new Henry Ransomware that appends the .henry217 extension.
May 4th 2021
New WastedLocker variant
dnwls0719 found a WastedLocker variant that appends the .saverswasted extension.
New Toxin Ransomware sold on hacker forums
3xp0rt noticed that a new Toxin Ransomware was being promoted on hacking forums.May 5th 2021
New STOP Ransomware variant
Michael Gillespie has found a new STOP Ransomware variant that appends the .rejg extension.
Cuba Ransomware Group on a Roll
At the end of 2020, our team, made up of SecurityJoes and Profero incident responders, led an investigation into a complex attack in which hundreds of machines were encrypted, knocking the victim company offline completely. The threat actors behind the attack deployed the Cuba ransomware across the corporate network, using a mixture of PowerShell scripts, SystemBC, and Cobalt Strike to propagate it. Cuba Ransomware utilizes the symmetric ChaCha20 algorithm for encrypting files, and the asymmetric RSA algorithm for encrypting key information
They Told Their Therapists Everything. Hackers Leaked It All
“If we receive €200 worth of Bitcoin within 24 hours, your information will be permanently deleted from our servers,” the email said in Finnish. If Jere missed the first deadline, he’d have another 48 hours to fork over €500, or about $600. After that, “your information will be published for all to see.”
May 6th 2021
A student pirating software led to a full-blown Ryuk ransomware attack
A student’s attempt to pirate an expensive data visualization software led to a full-blown Ryuk ransomware attack at a European biomolecular research institute.
Darkside Ransomware Overview
This is my report for one of the latest Windows samples of Darkside Ransomware v1.8.6.2!
May 7th 2021
Data leak marketplaces aim to take over the extortion economy
Cybercriminals are embracing data-theft extortion by creating dark web marketplaces that exist solely to sell stolen data.
Cuba Ransomware partners with Hancitor for spam-fueled attacks
The Cuba Ransomware gang has teamed up with the spam operators of the Hancitor malware to gain easier access to compromised corporate networks.
New GoNNaCry ransomware
dnwls0719 found a ransomware that appends the .GoNNaCry extension.
Insurer AXA halts ransomware crime reimbursement in France
In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals.
That’s it for this week! Hope everyone has a nice weekend!
