Threats tagged 'ransomware'

Ransomware Attack on Pennsylvania’s AG Office Disrupts Court Cases Source: https://www.infosecurity-magazine.com/news/ransomware-pennsylvania-ag/

Malware#infosecnews#redditGermany+9

So apparently agents are good enough nowadays that they can run a whole ransomware project on their own, getting in, lateral movement and then figuring out the appropriate ransom amount based on the information they got access to ...

Malware#infosecnews#redditGermany+9

The Interlock ransomware group has been actively targeting businesses and critical infrastructures in North America and Europe since September 2024. Their ransomware employs AES-256-GCM encryption with RSA-4096 key protection, leveraging the OpenSSL library for efficient file encryption. The malware includes code obfuscation techniques and specific arguments for various behaviors. It excludes certain folders, file extensions, and files from encryption to avoid system damage. The ransomware changes file extensions to '.!NT3RLOCK' and may terminate processes during encryption. Interlock's operations involve data theft and public disclosure threats for ransom leverage. The group utilizes a Tor-based negotiation site and references legal regulations to pressure victims. To counter this threat, offsite data backups and regular recovery drills are recommended.

Malware#aes-256-gcm#code obfuscationGermany+9

NightSpire, a ransomware group active since February 2025, employs aggressive tactics and a specialized infrastructure similar to Ransomware-as-a-Service models. They operate a Dedicated Leak Site, posting victim information and countdown timers for data release. The group uses threatening language and offers various communication channels for negotiations. NightSpire targets diverse industries across multiple countries, utilizing a double-extortion strategy. Their ransomware encrypts files using block or full encryption methods, with specific extensions encrypted in 1MB blocks for efficiency. Encrypted files receive a .nspire extension, and a ransom note is created in each affected folder. The ransomware's structure includes an AES symmetric key encrypted with an RSA public key at the end of each infected file.

Malware#south korea#aesPoland+1

PromptLock, a proof-of-concept AI-powered ransomware, leverages Lua scripts generated from hard-coded prompts to perform malicious activities across Windows, Linux, and macOS. Written in Go, it communicates with a locally hosted LLM through the Ollama API. The malware scans the filesystem, identifies sensitive information, and uses SPECK 128-bit encryption in ECB mode to encrypt files. It dynamically generates ransom notes and adapts its behavior based on the infected machine type. PromptLock's cross-platform compatibility and AI-driven script generation make it a significant concern for cybersecurity professionals, highlighting the need for advanced defensive strategies against evolving AI-powered threats.

Malware#proof-of-concept#speck encryptionGermany+7

This report highlights the importance of community engagement in cybersecurity, reflecting on experiences at major conferences like Black Hat USA 2025 and DEF CON 33. It discusses the value of these events for professional development and networking but notes their high costs and limited accessibility. The author encourages seeking alternative, more accessible opportunities such as local conferences, student clubs, and online resources. The report also mentions recent cybersecurity news, including a rise in ransomware attacks in Japan and warnings about exploited vulnerabilities, emphasizing the evolving nature of cyber threats and the need for continuous education and vigilance.

MATLAB dev says ransomware gang stole data of 10,000 people Source: https://www.bleepingcomputer.com/news/security/matlab-dev-says-ransomware-gang-stole-data-of-over-10-000-people/

Malware#infosecnews#redditGermany+6

Storm-0501 hackers shift to ransomware attacks in the cloud Source: https://www.bleepingcomputer.com/news/security/storm-0501-hackers-shift-to-ransomware-attacks-in-the-cloud/

Malware#infosecnews#redditGermany+6

First AI-Powered Ransomware PromptLock Targets Windows, Linux and macOS Source: https://hackread.com/first-ai-promptlock-ransomware-windows-linux-macos/

Malware#infosecnews#redditGermany+6

The Underground ransomware gang is conducting global attacks against companies across various countries and industries. First identified in July 2023, the group resurfaced in May 2024 with a new Dedicated Leak Site. Their targets include multinational corporations from diverse sectors, with annual revenues ranging from $20 million to $650 million. The ransomware uses a combination of RNG, AES, and RSA encryption techniques, with each file encrypted using a different AES key. The malware is designed to leave insufficient traces for decryption in the local environment. It categorizes files based on size and employs a striping method for larger files. The ransomware also deletes shadow copies, restricts remote desktop connections, and stops interfering services before encryption.

Malware#striping method#ransomwareFrance+3

ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html

Malware#infosecnews#redditGermany+9

Nissan confirms design studio data breach claimed by Qilin ransomware Source: https://www.bleepingcomputer.com/news/security/nissan-confirms-design-studio-data-breach-claimed-by-qilin-ransomware/

Malware#infosecnews#redditGermany+5

New Android Hook Malware Variant Locks Devices With Ransomware Source: https://hackread.com/android-hook-malware-variant-locks-devices-ransomware/

Malware#infosecnews#redditGermany+7

Tech Manufacturer Data I/O Hit by Ransomware Source: https://www.infosecurity-magazine.com/news/tech-manufacturer-data-io-hit-by/

Malware#infosecnews#redditGermany+4

HOOK Android Trojan Adds Ransomware Overlays, Expands to 107 Remote Commands Source: https://thehackernews.com/2025/08/hook-android-trojan-adds-ransomware.html

Malware#infosecnews#redditGermany+7

DaVita confirms ransomware attack compromised data of 2.7M people Source: https://securityaffairs.com/181458/data-breach/kidney-dialysis-firm-davita-confirms-ransomware-attack-compromised-data-of-2-7m-people.html

Malware#infosecnews#redditGermany+9

DaVita says ransomware gang stole data of nearly 2.7 million people Source: https://www.bleepingcomputer.com/news/security/davita-ransomware-attack-exposed-data-of-nearly-27-million-people/

Malware#infosecnews#redditGermany+6

Colt confirms customer data stolen as Warlock ransomware auctions files Source: https://www.bleepingcomputer.com/news/security/colt-confirms-customer-data-stolen-as-warlock-ransomware-auctions-files/

Malware#infosecnews#redditGermany+6

Qilin Ransomware Gang Claims 4TB Data Breach at Nissan CBI Source: https://hackread.com/qilin-ransomware-gang-4tb-data-breach-nissan-cbi/

Malware#infosecnews#redditGermany+9

The first half of 2025 saw a 1.4-fold increase in ransomware attacks in Japan compared to the previous year, with 68 confirmed cases. Small and medium-sized enterprises remained the primary targets, with manufacturing being the most affected industry. The ransomware group Qilin emerged as the most active threat, responsible for eight incidents. A new group, Kawa4096, appeared in late June, targeting Japanese companies. The analysis also details the KaWaLocker ransomware, including its configuration, encryption methods, and the emergence of KaWaLocker 2.0 with enhanced features. The continued evolution and intensification of ransomware activities in Japan highlight the need for increased cybersecurity measures across various industries.

Malware#kawa4096#japanGermany+9