BianLian Exploits TeamCity Vulnerability to Deploy Backdoors

BianLian cybercriminals deploying PowerShell backdoors for covert system access and control.

BianLian, a group of cybercriminals known for their ransomware attacks, recently caught the attention of the information security community. By exploiting vulnerabilities in the JetBrains TeamCity platform, they managed to carry out multistage cyberattacks. Threat actors reportedly start their attack chain with a Golang-based backdoor, and work their way all the way to the ransomware… Continue reading BianLian Exploits TeamCity Vulnerability to Deploy Backdoors

ALPHV Ransomware Shut Down, Exit Scam Supposed

Hackers allegedly try to pull an exit scam

On March 5, 2024, ALPHV/BlackCat ransomware claimed its shutdown, “due to the FBI takeover”. Despite the actions from law enforcement really happening to this gang before, there are quite a few signs of this being a false claim. Analysts suppose that ALPHV admins are just trying to pull an exit scam. ALPHV/BlackCat Ransomware Shuts Down… Continue reading ALPHV Ransomware Shut Down, Exit Scam Supposed

LockBit is Back With New Claims and Victims

Infamous fraudsters managed to recover their network infrastructure

The story around LockBit ransomware takedown on February 19 continues to unfold. After almost a week of downtime and silence, the infamous gang is back online on a new Onion domain, boasting new hacks. To top it all off, an infamous LockBitSupp released a lengthy statement about what happened and what’s next. LockBit Ransomware is… Continue reading LockBit is Back With New Claims and Victims

MrB Ransomware (.mrB Files) – Analysis & File Decryption

MrB is a novice ransomware sample. Remove it before recovering the files

MrB ransomware is a new Dharma ransomware sample, discovered on February 21, 2024. It is distinctive for applying a complex extension to the encrypted files that ends up with “.mrB”. This ransomware primarily attacks small corporations and asks the ransom only for decrypting the files, i.e. it does not practice double extortion. Jakub Kroustek was… Continue reading MrB Ransomware (.mrB Files) – Analysis & File Decryption

LockBit Ransomware Taken Down by NCA

LockBit was considered the toughest nuts, but then law enforcements pulled a nutcracker

On February 19, 2024, LockBit ransomware was taken down by the UK National Crime Agency in cooperation with a selection of other law enforcement agencies. The banner typical for such takedowns now illustrates all the web assets of LockBit ransomware. There is quite a hope about the possible release of decryption keys and even a… Continue reading LockBit Ransomware Taken Down by NCA

SYSDF Ransomware (.SYSDF Files) – Malware Analysis & Removal

New Dharma sample encrypts user files and adds .SYSDF extension to them

SYSDF is a ransomware-type program that belongs to the Dharma malware family. Such malicious software aims mainly at small companies, aiming at file encryption with further requests for ransom payment for their decryption. It was originally discovered by Jakub Kroustek on February 16, 2024. What is SYSDF Ransomware? SYSDF ransomware is a yet another example… Continue reading SYSDF Ransomware (.SYSDF Files) – Malware Analysis & Removal

White Phoenix Decryptor by CyberArk Updated With Web Interface

A rare universal decryptor for a selection of ransomware samples is now available online

CyberArk has released an online version of a file decryptor. This is a simplified, web version of the “White Phoenix” decryptor, initially available from the source code placed on GitHub. White Phoenix Decryptor by CyberArk Goes Online CyberArk, a public information security company that previously developed White Phoenix decrypter, has recently published a simplified web… Continue reading White Phoenix Decryptor by CyberArk Updated With Web Interface

Kasseika Ransomware Exploits Vulnerable Antivirus Drivers

Kasseika ransomware uses a vulnerable antivirus driver to stop security solutions in the attacked system

A new ransomware called “Kasseika” uses Bring Your Own Vulnerable Driver tactics to disable antivirus software before encrypting files. Kasseika was likely built by former members of the BlackMatter group or experienced ransomware actors who purchased its code. Kasseika Ransomware Deploys BYOVD Attacks A new ransomware operation known as “Kasseika” has recently been discovered. This… Continue reading Kasseika Ransomware Exploits Vulnerable Antivirus Drivers

LockBit Ransomware Uses Resume Word Files to Spread

LockBit ransomware group is back to utilizing Word files to distribute the payload.

A recent investigation by ASEC reveals the new tactics of an infamous LockBit ransomware. “Post-paid pentesters” started masquerading as innocuous summaries in Word documents. Ironically, this similar tactic is reminiscent of its past modus operandi. This clever tactic allows the ransomware to infiltrate systems unnoticed. LockBit Ransomware in action The LockBit ransomware, known for its… Continue reading LockBit Ransomware Uses Resume Word Files to Spread

Tortilla (Babuk) Ransomware Decryptor Available

Cisco Talos and Avast Threat Labs elaborated a decryptor for Tortilla ransomware

On January 9, 2024, Avast and Cisco Talos announced the release of a free decryptor for one of the Babuk ransomware variants – Tortilla. Analysts ensure that all the victims of the said threat actor can use the decryptor to get their files back. That is the second ransomware strain to get the decryptor in… Continue reading Tortilla (Babuk) Ransomware Decryptor Available