Thursday, March 28, 2024

NCSC Issued an Emergency Alert for Ryuk Ransomware that Actively Attacks on Global Organizations

National Cyber Security Centre (NCSC) from the UK issued an alert for Ryuk ransomware attack that is actively targeting global organization associated with Emotet and TrickBot malware.

Researcher uncovered this ongoing Ryuk ransomware infection identified in the various organization network along with Emotet and TrickBot infection.

Ryuk Ransomware initially uncovered in August 2018 since then it infects and compromise various organization and steals millions of dollars from affected victims.

Emotet is one of the notorious malware family that infects various victims around the world and is used as a dropper for initial stage infection by other Trojans.

Trickbot is a banking malware which steals login credentials from applications. Since it was discovered long back ago, the threat actors continuously adding new capabilities to the malware.

Ryuk Ransomware using TrickBot and Emotet malware in its attack chain targeting large organizations for a high-ransom return and the Ryuk believed to be operated by GRIM SPIDER, a sophisticated hacking group.

Ryuk Ransomware infection Functionality

Ryuk ransomware using Emotet for the initial stage of infection and check the victim’s machine, whether it vulnerable to infection or not.

At the same time, Trickbot subsequently deploys additional post-exploitation tools to enable their operations, including powerful
Mimikatz and PowerShell Empire modules.

Post exploitation modules are used for credential harvesting, remotely monitoring of the victim’s workstation to infect a further system in the same network.

Machines infected with Emotet periodically check for modules from a command and control server (C2). These modules are typically DLLs or EXEs which are loaded on an infected system for extending capabilities.

All the non-executable file will be encrypted at the end of the infection process and displaying the ransomware notes with the demand of ransom amount in bitcoin.

“Ryuk is a persistent infection. The malware’s installer will attempt to stop certain antimalware software and install the appropriate version of Ryuk depending on a system’s architecture.”

According to NCSC, The Ryuk ransomware itself does not contain the ability to move laterally within a network, hence the reliance on access via a primary infection, but it does, however, have the ability to enumerate network shares and encrypt those it can access. This, coupled with the ransomware’s use of anti-forensic recovery, a technique to make recovering from backups difficult.

You can read more about the indicators of compromise and NCSC advisory Notes Here.

Read: Ransomware Attack Response and Mitigation Checklist

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

Massive Ryuk Ransomware Attack on Entire Computers of Jackson County, Georgia – $400,000 Ransom Paid

A Scary Evolution & Alliance of TrickBot, Emotet and Ryuk Ransomware Attack

Ryuk Ransomware Attack on various Enterprise Network Around the World & Earned $640,000

FIN6 Hackers Group Targeting Enterprise Network to Deploy LockerGoga and Ryuk Ransomware

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles