This devious attack could be the next evolution of ransomware

Date:
Tue, 03 Jan 2023 21:22:15 +0000

Description:
Ransomware gang leak financial firm's data on fake version of company's website

FULL STORY ======================================================================

A ransomware operator has created a fake website of one of its victims and used it to publish sensitive content stolen in a ransomware attack.

The approach is a novelty that some security researchers believe to be a way of weaponization of the victims clients.

Threat actors known as ALPHV (also known as BlackCat), recently successfully launch a ransomware attack against a financial services company, making off with 3.5GB of sensitive documents, including staff memos, payment forms, employee data, assets and expenses, financial data for partners, passport scans, and similar. Typosquatted domains

The threats of leaking the data to the public obviously didnt work with the victim company, which evidently decided not to pay the ransom demand.

However, ransomware operators usually leak stolen data on the dark web, where its available mostly to other criminals and security researchers. This time around, ALPHV created a website on a typosquatted domain, which looks and feels almost identical to the legitimate website of the victim. Read more

What is ransomware and how does it work?

You're a ransomware victim: Here's 5 things you should do

Here are the best malware removal tools around

Speaking to BleepingComputer , threat analyst at Emsisoft, Brett Callow, said leaking the data via a typosquatted domain could be a more damaging approach: I wouldn't be at all surprised if Alphv had attempted to weaponize the firm's clients by pointing them to that website Brett Callow said.

We will have to wait and see what the results of this approach would be, but its safe to assume that if its successful, well be seeing a lot more typosquatted websites leaking sensitive corporate data.

Ransomware is an ever-evolving threat. At first, the attackers would simply encrypt all of the files on target endpoints and demand payment in bitcoin.

When businesses started deploying backups, the criminals started stealing sensitive data and threatening to leak it online. In some cases, this attack is also followed by a Distributed Denial of Service (DDoS) attack that disrupts the front-end, as well as intimidation and persuasion via telephone and email. Here are the best endpoint protection services right now

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/this-devious-attack-could-be-the-next-evolution -of-ransomware


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)