A #Sodinokibi campaign broke out last week using "Outstanding statement" emails in the Chinese language, with the ransomware itself inside a .zip archive as attachment, a notable change from past campaigns that used drive-by downloads or emails with malicious URLs 
The ransomware is an .exe file that pretends to be .xls using double extensions. It runs a PowerShell command to delete the shadow copy, encrypts & renames files with alphanumeric characters as extension (ex., myfile.x63b59), drops ransom note, changes the desktop background
Office 365 ATP catches the malicious attachments used in this new Sodinokibi campaign, protecting customers from ransomware infection. Microsoft Defender ATP blocks the malware on endpoints and raises alerts for malicious behaviors, including shadow copy deletion.
Sodinokibi ransomware variants used in this campaign include SHA-256: a7ed45d953d2cb6625ed510540e6ccc720277577dc101531e9b144df4b267926, 45dbbf06d0e11aef8741dfc106acec0de60cec8580ef0fa8051c39a4b4843640, c367383edc64121fb526958fa98f91c89808538ab131df06be7ce8f67205dbdf
• • •
Missing some Tweet in this thread? You can try to
force a refresh
