With this article we are bringing you the latest ransomware news that occurred over the past two weeks. The news is a still a little light due to some of us taking vacations, but we should be back up to speed next week.
Over the past two weeks we have seen quite a bit of activity from the Ryuk crew who targeted organizations around the world and asked for large ransoms. We also saw other ransomware target organizations such as school districts, the Shakespeare Theatre of New Jersey, Great Plains Health, a U.S. data center, and a museum.
In addition, a new ransomware called DeathRansom had a surge in victims and we continue to see new variants of Dharma, STOP, and others being released at a rapid pace.
Ransomware is not going away, so make sure you get a working backup plan in place as ransomware is ineffective against working backups.
Contributors and those who provided new ransomware information and stories this week include: @struppigel, @demonslay335, @FourOctets, @fwosar, @malwareforme, @BleepinComputer, @DanielGallagher, @malwrhunterteam, @jorntvdw, @LawrenceAbrams, @PolarToffee, @Seifreed, @1ZRR4H, @JakubKroustek, @emsisoft, @McAfee_Labs, @Amigo_A, and @siri_urz.
November 24th 2019
Livingston School District in New Jersey Hit With Ransomware
Students at the Livingston public school district in New Jersey are undoubtedly happy for a two hour delayed opening tomorrow. Unfortunately, this delay is not being caused by snow, but rather by a ransomware attack that the district is still recovering from.
November 25th 2019
New Rote STOP Ransomware variant
Amigo-A found a new variant of the STOP ransomware that appends the .rote extension.
New Crypto Scarab Ransomware variant
Amigo-A found a new variant of the Scarab Ransomware that appends the .crypto extension and drops a ransom note named !!! RETURN YOUR FILES !!!.TXT.
November 26th 2019
New DeathRansom Ransomware Begins to Make a Name for Itself
A new ransomware called DeathRansom began with a rocky start, but has now resolved it's issues and has begun to infect victims and encrypt their data.
New Roger Dharma Ransomware variant
Jakub Kroustek found a new Dharma Ransomware variant that appends the .ROGER extension to encrypted files.
November 27th 2019
Ryuk Ransomware Forces Prosegur Security Firm to Shut Down Network
In a statement at midday today (local time), Spanish multinational security company Prosegur announced that it was the victim of a cybersecurity incident disrupting its telecommunication platform.
Ransomware Locks Medical Records at Great Plains Health
Great Plains Health medical center is recovering from a ransomware incident that hit its computer network at the beginning of the week and forced switching to pen and paper to maintain activity.
November 28th 2019
Dutch Govt Warns of 3 Ransomware Infecting 1,800 Businesses
A confidential report from the National Cyber Security Centre (NCSC) in the Netherlands informs that at least 1,800 companies are affected by ransomware across the world.
New Bitx and IMI Dharma Ransomware variant
Jakub Kroustek found new Dharma Ransomware variants that append the .bitx or .IMI extensions to encrypted files.
November 29th 2019
Clop Ransomware asks you not to use Gmail
MalwareHunterTeam noticed that the CryptoMix Clop Ransomware is now telling users not to use Gmail as it goes into the spam folder.
December 2nd 2019
The history of Ransomware: A supervillain 30 years in the making
Unlike other supervillains, Ransomware had no defining life event which set him on a path of evil and criminality. On the contrary, Ransomware was a bad actor from the very moment he was conceived…
December 3rd 2019
Ryuk Ransomware Is Making Victims Left and Right
While doing some open-source intelligence (OSINT), a security researcher discovered that a provider of end-to-end solutions for emergency care facilities in the U.S. fell victim to Ryuk ransomware.
December 5th 2019
Analysis of LooCipher, a New Ransomware Family Observed This Year
The McAfee ATR team has now analyzed a new ransomware family with some special features we would like to showcase. LooCipher represents how a new actor in an early stage of development used the same techniques of distribution as other players in the ransomware landscape. The design of the ransomware note reminded us of the old times of Cerber ransomware, a very well impacted design to force the user to pay the rescue.
New RedRum Ransomware
Michael Gillespie found a new ransomware that appends the .redrum extension and drops a ransom note named decryption.txt. They obviously like Stephen King.
New Righ Stop Ransomware variant
Michael Gillespie found a new STOP ransomware variant that appends the .righ extension.
New BlackHeart ransomware variant
S!Ri found a new variant of the BlackHeart Ransomware.
December 6th 2019
U.S. Data Center Provider Hit by Ransomware Attack
CyrusOne, a large data center provider in the U.S., announced on Thursday that some of its systems were affected by a ransomware attack.
Ransomware Writes Drama at Shakespeare Theatre
A ransomware attack over the weekend has taken down the ticketing system and patron database for the New Jersey Shakespeare Theatre and has also affected at least one other organization in the Madison area.
New b1 Paradise Ransomware variant
Michael Gillespie found a new Paradise Ransomware variant that appends the .b1 extension. This variant is not decryptable.
New Zeppelin Ransomware
Michael Gillespie noticed that the new Zeppelin ransomware pays homage to Led Zeppelin in its musical file marker. Also appends the .[3 hex]-[3 hex]-[3 hex] extension to encrypted files and drops a ransom note named readme.txt.
