‘NamPoHyu Virus’ Ransomware Targets Samba Servers and Encrypt Files Remotely

New ransomware spotted NamPoHyu Virus or MegaLocker virus targeting the remote samba servers in a unique way.

The common way of delivering ransomware is through email attachments or by compromising the victim’s network and ransomware infection are installed on the computer that to be encrypted.

The new variant searches for the samba servers that are accessible online, brute force them and then remotely encrypt the files.

The MegaLocker virus was first found in March 2019 on NAS devices, it uses to encrypt the files and append a .crypted extension to encrypted files.

Starting from this April 2019, it has been changed to NamPoHyu Virus it uses to encrypt the files and append.NamPoHyu extension to encrypted files.

It encrypts the file’s in the system and asks to make ransom payment through Tor site, for personal victims $250 and $1,000 USD in bitcoins for companies.

According to Shodan results more than 500,000 Samba servers are available remotely if the infection gain access to all the servers then it could be a massive one.

Ransomware is the fast-growing threat and it is considered as a leader of Global cyber attack in recent days. It encrypts all the system files and asks for ransom payments to unlock it.

Here you can find the Ransomware Attack Response and Mitigation Checklist.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago