‘NamPoHyu Virus’ Ransomware Targets Samba Servers and Encrypt Files Remotely

New ransomware spotted NamPoHyu Virus or MegaLocker virus targeting the remote samba servers in a unique way.

The common way of delivering ransomware is through email attachments or by compromising the victim’s network and ransomware infection are installed on the computer that to be encrypted.

The new variant searches for the samba servers that are accessible online, brute force them and then remotely encrypt the files.

The MegaLocker virus was first found in March 2019 on NAS devices, it uses to encrypt the files and append a .crypted extension to encrypted files.

Starting from this April 2019, it has been changed to NamPoHyu Virus it uses to encrypt the files and append.NamPoHyu extension to encrypted files.

It encrypts the file’s in the system and asks to make ransom payment through Tor site, for personal victims $250 and $1,000 USD in bitcoins for companies.

According to Shodan results more than 500,000 Samba servers are available remotely if the infection gain access to all the servers then it could be a massive one.

Ransomware is the fast-growing threat and it is considered as a leader of Global cyber attack in recent days. It encrypts all the system files and asks for ransom payments to unlock it.

Here you can find the Ransomware Attack Response and Mitigation Checklist.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…

1 day ago

Skuld Malware Using Weaponized Windows Utilities Packages To Deliver Malware

Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…

2 days ago

BellaCiao, A new .NET Malware With Advanced Sophisticated Techniques

An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…

2 days ago

Malicious Apps On Amazon Appstore Records Screen And Interecpt OTP Verifications

A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…

2 days ago

Lazarus Hackers Using New VNC Based Malware To Attack Organizations Worldwide

The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…

2 days ago

New Python NodeStealer Attacking Facebook Business To Steal Login Credentials

NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…

2 days ago