Tweet

@thepacketrat

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @SophosLabs

SophosLabs

@SophosLabs

11 Jun

NEW insights ☠️

Relentless REvil, revealed: RaaS as variable as the criminals who use it

No two criminal groups deploy the ransomware-as-a-service (RaaS), also known as Sodinokibi, in exactly the same way...

(a thread) 1/11

As attacks involving RaaS malware, including REvil, increasingly have generated attention, we wanted to pull together a common body of our knowledge about the ransomware itself, and the variety we observe in attack methods employed by the criminals who lease the software. 2/11

We've also reviewed reports from Sophos Rapid Response about attacks involving Sodinokibi/REvil where the MTR team were hired to provide incident response and cleanup. From these detailed analyses, we were able to develop a picture of a common malware being deployed. 3/11

Read 11 tweets

SophosLabs

@SophosLabs

2 Jun

NEW: AMSI bypasses remain tricks of the malware trade

Malware developers continue to try to sabotage or evade Microsoft’s Anti-Malware Software Interface in “fileless” and living-off-land attacks...

(a thread) 1/13

As Windows 10 and the latest generation of Windows Server platforms have risen to prominence, malware developers and malicious actors have increasingly aimed to evade detection by taking out those platforms’ anti-malware traffic cop: Microsoft’s Antimalware Scan Interface. 2/13

AMSI, introduced in 2015, provides a way for software to talk to security products, requesting scans of files, memory, or streams for malicious payloads in a vendor-agnostic way. 3/13

Read 13 tweets

SophosLabs

@SophosLabs

1 Jun

A NEW ransomware enters the fray: Epsilon Red

A bare-bones ransomware offloads most of its functionality to a cache of PowerShell scripts...

(a thread) 1/13

Sophos analysts uncovered a new ransomware written in the Go programming language that calls itself Epsilon Red.

The malware was delivered as the final executable payload in a hand-controlled attack in which every other early-stage component was a PowerShell script. 2/13

While the name and tooling were unique to this attacker, the ransom note left behind resembles the note left behind by REvil ransomware, but adds a few minor grammatical corrections.

There were no other obvious similarities between the Epsilon Red ransomware and REvil. 3/13

Read 13 tweets

SophosLabs

@SophosLabs

12 May

NEW RESEARCH: A defender's view inside a #DarkSide ransomware attack ***

What to expect when you’re targeted by a headline-seeking threat actor... (a thread)

1/8

The recent ransomware intrusion of a major US gasoline pipeline operator was the work of an affiliate of #DarkSide, a ransomware ring that has been responsible for at least 60 known cases of ransomware double-extortion so far this year.

2/8

DarkSide has struck several high-profile victims recently, including companies listed on the NASDAQ stock exchange.

3/8

Read 8 tweets

SophosLabs

@SophosLabs

11 May

NEW: May’s Patch Tuesday brings a lighter-than-usual number of Windows updates

... But fewer patches does not make the bugs less dangerous

(a thread) 1/9

The recent history of Patch Tuesday releases has seen Microsoft updating upwards of 100 software bugs every month, but that trend is broken today when the company fixes just 55 vulnerabilities across their products. 2/9

Synchronized to release in parallel with Microsoft’s updates, Adobe is also fixing 11 bugs in their Acrobat Reader software, one of which (CVE-2021-28550/APSB21-29) is reportedly being “exploited in the wild in limited attacks targeting Adobe Reader users on Windows,” 3/9

Read 10 tweets

SophosLabs

@SophosLabs

23 Mar

NEW RESEARCH: Black Kingdom ransomware begins appearing on Exchange servers

***
A novel, if not particularly well made, ransomware is spreading to Exchange servers that haven't been patched against the ProxyLogon exploit.

(a thread)

1/15

Following the #DearCry ransomware attacks reported on last week, another ransomware gang has also started to target vulnerable Exchange servers with another ransomware, called #BlackKingDom.

2/15

Sophos telemetry began detecting the ransomware on Thursday March 18 as it targeted Exchange servers that remain unpatched against the ProxyLogon vulnerabilities disclosed by Microsoft earlier this month.

3/15

Read 15 tweets

Share this page!

SophosLabs

Try unrolling a thread yourself!

More from @SophosLabs

SophosLabs

SophosLabs

SophosLabs

SophosLabs

SophosLabs

SophosLabs

Did Thread Reader help you today?

Like this author's thread?