Wednesday, April 17, 2024

Threat Actors English-Speaking Countries with Customized Yashma Ransomware

An unidentified threat actor has deployed the Yashma ransomware variant since June 4, 2023, actively targeting English-speaking countries like:-

  • Bulgaria
  • China
  • Vietnam

While this new variant of Yashma ransomware has reemerged after being fixed last year since the release of a decryptor.

This operation was recently identified by the cybersecurity researchers at Cisco Talos, who linked this operation, with moderate confidence, to a probably Vietnamese-origin threat actor.

Threat Actor’s origin 

Talos highly believes the threat actor targets English-speaking countries due to ransomware notes on the ‘nguyenvietphat’ GitHub account. 

Besides this, the English version suggests the actual intent of the threat actor to target various geographic regions.

GitHub account name and email contact in ransom notes mimic Vietnamese organizations, implying the threat actor’s origin. The ransom note specifies 7-11 p.m. UTC+7 contact time, aligning with the time zone of Vietnam.

Ransom Note Mimics WannaCry Style

The ransom note of the attacker mimics WannaCry’s style, and the ransom gets doubled after three days. While for communication, the threat actor provides a Gmail address and lack of ransom amount, and Bitcoin in the note suggests that the operation is in the early stage.

Ransom notes samples (Source – Cisco Talos)

Once systems are encrypted, the victim’s wallpaper changes to a note of encryption. Yashma ransomware is a rebrand of Chaos ransomware from May 2022, and this new variant mostly retains the features of the original ransomware.

WannaCry style ransom encryption screen (Source – Cisco Talos)

The ransom note mimics the style of WannaCry ransomware, potentially aimed at confusing the targets and hiding the identity of the threat actor.

WannaCry style screen (Source – Cisco Talos)

However, the new variant downloads the ransom note from a threat actor’s GitHub repo instead of storing it within the ransomware.

This transformation evades the endpoint detection and AV tools that typically spot embedded ransom note strings.

In this variant, the threat actor retains Yashma’s anti-recovery ability. After encryption, files are wiped, a single character ‘?’ is written, and then the file is deleted, which complicates the recovery.

Moreover, it’s been observed by researchers a significant surge in the emergence of various ransomware strains.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


Latest articles

LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

Hackers target Apple device users because they are perceived to be of higher social...

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles