Today, the Russian government announced that they arrested fourteen members of the REvil ransomware gang on behalf of US authorities.
While the ransomware gang members are only being charged with “illegal circulation of means of payment,” the arrests are the first public action by Russia to stem the activities of ransomware gangs operating within the country.
Furthermore, Russia states that they took this action on behalf of US law enforcement, who they have historically been reluctant to help in criminal cybercrime investigations.
However, some threat actors believe that this is just Russia trying to appease the USA and that future law enforcement cooperation will not be common.
Ukrainian police also arrested members of a ransomware operation who encrypted at least fifty firms in the USA and Europe. However, the name of the ransomware gang has not been disclosed.
Other news this week is the finding of a Linux encryptor for the AvosLocker ransomware operation that targets VMware ESXi, the Night Sky ransomware operation using Log4j attacks, TellYouThePass returns as a multi-platform Golang threat, and that Magniber ransomware using signed APPX files to infect victims.
Contributors and those who provided new ransomware information and stories this week include: @fwosar, @BleepinComputer, @DanielGallagher, @PolarToffee, @malwrhunterteam, @demonslay335, @billtoulas, @jorntvdw, @serghei, @VK_Intel, @malwareforme, @struppigel, @LawrenceAbrams, @FourOctets, @Ionut_Ilascu, @Seifreed, @ahnlab, @CrowdStrike, @MsftSecIntel, @ChristiaanBeek, @fbgwls245, @Amigo_A_,@JakubKroustek, and @pcrisk.
January 8th 2022
New Wasp Ransomware
dnwls0719 found the new Wasp Ransomware that appends the .0.locked extension to encrypted files.
January 10th 2022
Linux version of AvosLocker ransomware targets VMware ESXi servers
AvosLocker is the latest ransomware gang that has added support for encrypting Linux systems to its recent malware variants, specifically targeting VMware ESXi virtual machines.
FinalSite: No school data stolen in ransomware attack behind site outages
FinalSite announced today the findings of a six-day investigation into last week’s ransomware attack, stating it found no evidence schools’ data accessed or stolen by hackers.
New STOP Ransomware variant
Jakub Kroustek found a new STOP ransomware variant that appends the .nqhd extension.
January 11th 2022
Night Sky ransomware uses Log4j bug to hack VMware Horizon servers
The Night Sky ransomware gang has started to exploit the critical CVE-2021-44228 vulnerability in the Log4j logging library, also known as Log4Shell, to gain access to VMware Horizon systems.
January 12th 2022
Magniber ransomware using signed APPX files to infect systems
The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.
TellYouThePass ransomware returns as a cross-platform Golang threat
TellYouThePass ransomware has re-emerged as a Golang-compiled malware, making it easier to target more operating systems, macOS and Linux, in particular.
School’s out as cyberattack forces APS to cancel classes
A cyberattack against Albuquerque Public Schools prompted the state’s largest district to cancel all classes districtwide on Thursday and possibly Friday.
New STOP ransomware variant
PCrisk found a new STOP ransomware variant that appends the .zaqi extension to encrypted files.
January 13th 2022
Ukranian police arrests ransomware gang that hit over 50 firms
Ukrainian police officers have arrested a ransomware affiliate group responsible for attacking at least 50 companies in the U.S. and Europe.
January 14th 2022
Russia arrests REvil ransomware gang members, seize $6.6 million
The Federal Security Service (FSB) of the Russian Federation says that they shut down the REvil ransomware gang after U.S. authorities reported on the leader.
That’s it for this week! Hope everyone has a nice weekend!
Source: www.bleepingcomputer.com