This devious ransomware is now more dangerous than ever

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • PCHF IT Feeds
    PCHF Bot
    • Jan 2015
    • 54572

    #1

    This devious ransomware is now more dangerous than ever

    With new obfuscation techniques, and attack capabilities, the Hello XD ransomware is now more dangerous than ever before, Unit 42, Palo Alto Networks’ cybersecurity arm, has found.

    The group discovered Hello XD now features a new encryptor featuring custom packing, that helps the malware stay hidden. What’s more, it comes with new changes to the encryption algorithm. Instead of the modified HC-128 and Curve25519-Donna, this newly discovered version comes with Rabbit Cipher and Curve25519-Donna. Furthermore, the file marker no longer features a coherent string, but rather carries random bytes, further strengthening the cryptography.

    Also, the strain carries a link to an onion site, but according to researchers, the site is currently offline, possibly pending construction.


    https://cdn.mos.cms.futurecdn.net/ybbmQ8p4Q999AkMWkW8HLm.jpg


    Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

    [HEADING=1]Deploying MicroBackdoor[/HEADING]

    Usually, ransomware operators do two things during their attack: exfiltrate all of the sensitive data to a location they can control, and encrypt everything they find on the target network. That way, in case the victim has a backup solution, they can still threaten to release sensitive data online, or sell it to a third party.

    Hello XD takes it a step further, it was found, as besides the ransomware, the threat actor also deploys MicroBackdoor, an open-source backdoor that allows remote code execution, file exfiltration, and system modifications.

    Read more
    Most ransomware victims pay up, but many never recover their data

    Ransomware actors have found a new way to make victims pay up

    This weird ransomware can only be decrypted by going to the Roblox store
    The malware’s executable is encrypted with WinCrypt API, and embedded within the ransomware payload, it was said. It also doesn’t have a specific amount of money in mind, that it seeks to gain in exchange for the decryption key. Instead, it tells victims to open up a TOX chat service and start a negotiation process.

    Hello XD was first spotted late last year, when researchers described it as a spin-off from the then-popular Babuk ransomware. This newly discovered version, however, is a significant step away from Babuk, suggesting that the threat actors behind it plan on developing it further.

    To stay safe from cyberattacks, businesses are urged to educate their employees on the dangers of phishing, keep their software up to date, and set up a strong antivirus and firewall solution.

    Via: BleepingComputer

    Continue reading…
Working...