This odd ransomware will target your business servers, but then ask for a donation to charity

Date:
Thu, 18 May 2023 18:09:33 +0000

Description:
New ransomware group tells victims to donate money to charity in exchange for the decryptor.

FULL STORY ======================================================================

Some hackers are in it for the money, while others are working for their governments, wreaking havoc and stealing data from opposing nations. But
there is a small percentage of hacktivists - groups that dont shy away from criminal activity, as long as its for a positive and socially acceptable
goal.

One such group has recently been spotted targeting businesses Zimbra servers with ransomware . Instead of taking the ransom payment for themselves, theyre demanding victims make a donation to a charity of their choosing.

The group is called MalasLocker and seems to be from a Spanish-speaking country, as its data leak site, discovered by cybersecurity researcher from Emsisoft, Brett Callow, is titled "Somos malas... podemos ser peores," which is Spanish for "We are bad... we can be worse. So far, the group is leaking sensitive data belonging to three breached organizations, as well as Zimbra configurations for 169 other victims. MalasLocker

The group appears to have started its campaign in late March 2023, further stating that its yet unclear how they managed to compromise the Zimbra servers, if they discovered any zero-day vulnerabilities and developed any malware for it.

Once they breach the servers and encrypt the files, they leave a ransom note with a unique message: "Unlike traditional ransomware groups, we're not
asking you to send us money. We just dislike corporations and economic inequality," they say. "We simply ask that you make a donation to a
non-profit that we approve of. It's a win-win, you can probably get a tax deduction and good PR from your donation if you want." Read more

Hitachi Energy confirms data breach after being hit by Clop ransomware

Hatch Bank says 140,000 customers had data stolen after breach

Here's our rundown of the best ID theft protection out there

The groups leak site carries a similar message, but with a crucial
difference:

"We're a new ransomware group that have been encrypting companies' computers to ask they donate money to whoever they want ," it says. "We ask they make a donation to a nonprofit of their choice, and then save the email they get confirming the donation and send it to us so we can check the DKIM signature to make sure the email is real."

So far, theres no confirmation the attackers really distribute the decryptor to the companies that make the payment. These are the best endpoint security tools right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/this-odd-ransomware-will-target-your-business-s ervers-but-then-ask-for-a-donation-to-charity


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)