Malware

REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation

From Intel471’s Malware Intelligence Team: REvil aka Sodinokibi, Sodin is a ransomware family operated as a ransomware-as-a-service (RaaS). Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725. REvil is highly configurable and allows operators to customize the way it behaves on the...

Kwampirs Malware Employed in Ongoing Cyber Supply Chain Campaign Targeting Global Industries, including Healthcare Sector

The summary from  Private Industry Notification #20200330 by the FBI, issued March 30: Since at least 2016, the FBI has observed an Advanced Persistent Threat (APT) actor conduct a global network exploitation campaign using the Kwampirs Remote Access Trojan (RAT) and is providing additional, non-technical information in an effort to highlight key objectives of...

Three More Ransomware Families Create Sites to Leak Stolen Data

Lawrence Abrams reports that three more ransomware families have adopted the model of using websites to leak victims’ data if they don’t pay extortion demands: Nefilim Ransomware has launched a site called “Corporate Leaks” CLOP Ransomware — the team behind the Maastricht University attack — has also released a leak site called “>_CL0P^_- LEAKS” ...