ransomware

Pierluigi Paganini November 19, 2017
A second variant of the new Cryptomix Ransomware released in a few days

Malware researchers at MalwareHunterTeam discovered a new variant of the CryptoMix ransomware, the second one in just a few days. A new variant of the CryptoMix ransomware was recently discovered by the experts at the MalwareHunterTeam, it is the second release of new variants this week. The latest variant appends the. 0000 extension to encrypted files and uses new contact emails, for example, […]

Pierluigi Paganini November 10, 2017
Ordinypt is a wiper disguised as ransomware that targets German users

Security experts spotted a new malware dubbed Ordinypt, it is a wiper disguised as ransomware that currently only targets German users The malware researcher Michael Gillespie first reported a new strain of malware called Ordinypt that is currently targeting German users, but unfortunately instead of encrypting users’ files, the malware intentionally destroy them. Tweets by demonslay335 Early this […]

Pierluigi Paganini November 06, 2017
The GIBON Ransomware appears in the threat landscape

A new strain of ransomware dubbed GIBON ransomware was spotted by the ProofPoint researcher Matthew Mesa that observed it being distributed via malspam. The spam messages use a malicious document as attachment containing macros that once enabled will download and install the ransomware on a victim’s machine. The researcher dubbed the ransomware GIBON because of the presence of the string “GIBON” in two […]

Pierluigi Paganini November 01, 2017
CSE Malware ZLab – Full report of Bad Rabbit attack

The researchers at CSE Cybsec ZLab have completed their analysis the Bad Rabbit ransomware, the report follows our preliminary analysis. Introduction Recently a new ransomware, called BadRabbit, infected systems in many countries, most of in East Europe, such as Ukraine and Russia. The malware was not totally new, it seems to be an evolution of the old […]

Pierluigi Paganini November 01, 2017
MBR-ONI ransomware involved in targeted attacks against Japanese organizations

MBR-ONI is a new ransomware that is being used for targeted attacks in Japan, experts speculate it was used to cover larger hacking campaigns. MBR-ONI is a new ransomware that is being used for targeted attacks in Japan, it is a bootkit ransomware that uses a modified version of the legitimate open-source disk encryption utility DiskCryptor to […]

Pierluigi Paganini October 31, 2017
Experts spotted a new strain of the Sage Ransomware that implements Anti-Analysis capabilities

Security experts from Fortinet spotted a new strain of the Sage ransomware that included new functionalities, such as anti-analysis capabilities. Sage 2.0 is a new ransomware first observed in December and not now it is distributed via malicious spam. Sage is considered a variant of CryLocker ransomware, it is being distributed by the Sundown and RIG exploit kits. The […]

Pierluigi Paganini October 28, 2017
Documents encrypted by Bad Rabbit ransomware could be recovered without paying ransom

Files Encrypted by Bad Rabbit Recoverable Without Paying Ransom. Some victims of the recent Bad Rabbit attack may be able to recover their files encrypted by the ransomware without paying the ransom. The discovery was made by researchers at Kaspersky Lab that analyzed the encryption functionality implemented by the ransomware. Once the ransomware infects a computer, […]

Pierluigi Paganini October 27, 2017
UK Government links the WannaCry attack that crippled NHS to North Korea

UK Government blamed North Korea for the WannaCry attack that affected a third of English hospitals. “This attack, we believe quite strongly that it came from a foreign state,” Ben Wallace, a junior minister for security, told BBC Radio 4’s Today programme. “North Korea was the state that we believe was involved in this worldwide attack,” […]

Pierluigi Paganini October 25, 2017
CSE Malware ZLab – Preliminary analysis of Bad Rabbit attack

We at the CSE Cybsec ZLab have conducted a preliminary analysis of the Bad Rabbit ransomware discovering interesting aspects of the attack. This is just the beginning of a complete report that we will release in the next days, but we believe our findings can be useful for the security community. This malware remembers the notorious NotPetya basically […]

Pierluigi Paganini October 14, 2017
DoubleLocker, the Android Ransomware that encrypts files and changes PIN Lock

Crooks have developed a strain of Android ransomware dubbed Doublelocker that both encrypts user data and changes PIN Lock. DoubleLocker, the name says it all, is a new malware that not only encrypts the Android mobile devices but also changes PIN lock. The DoubleLocker ransomware was discovered by security researchers from cybersecurity firm ESET. DoubleLocker is the first-ever […]