Malware

Bits ‘n Pieces (Trozos y Piezas)

UY: Ministry of Transport and Public Works victim of ransomware attack Uruguay’s Ministry of Transport and Public Works (MTOP) was hit by a ransomware attack on October 17. On November 9, MTOP reported that it was back to normal after the ransomware attack, adding that it had recovered critical information and restored the affected...

#StopRansomware: Cuba Ransomware

Joint Cybersecurity Advisory Product ID: AA22-335A December 1, 2022 TLP:CLEAR The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known Cuba ransomware IOCs and TTPs associated with Cuba ransomware actors identified through FBI investigations, third-party reporting, and open-source reporting. This advisory updates...

Hackers are locking out Mars Stealer operators from their own servers

Zack Whittaker reports: A security research and hacking startup says it has found a coding flaw that allows it to lock out operators of the Mars Stealer malware from their own servers and release their victims. Mars Stealer is data-stealing malware as a service, allowing cybercriminals to rent access to the infrastructure to launch...

Sandworm gang launches Monster ransomware attacks on Ukraine

Jeff Burt reports: The Russian criminal crew Sandworm is launching another attack against organizations in Ukraine, using a ransomware that analysts at Slovakian software company ESET are calling RansomBoggs. In a Twitter thread, the ESET researchers wrote that they had detected RansomBoggs deployed within the networks of “multiple organizations in Ukraine.” While some aspects of...

Trigona ransomware spotted in increasing attacks worldwide

Lawrence Abrams reports: A previously unnamed ransomware has rebranded under the name ‘Trigona,’ launching a new Tor negotiation site where they accept Monero as ransom payments. Trigona has been active for some time, with samples seen at the beginning of the year. However, those samples utilized email for negotiations and were not branded under...