52 matches found
TAU Threat Intelligence Notification: BlackRouter Ransomware
According to the article from BleepingComputer, BlackRouter Ransomware was being promoted as a Ransomware-as-a-Service on Telegram by an Iranian developer. BlackRouter Ransomware will append ‘.BlackRouter’ as file extension to the encrypted file. In addition, it will attempt to delete volume shad...
TAU Threat Intelligence Notification – Crypt0r Ransomware
Summary Crypt0r ransomware is a new strain of ransomware that operates similar to WannaCry and NotPetya. When executed, it first checks for a hardcoded mutex value, and if it isn’t found, creates it as “crypt0r-mutex”. It then retrieves the temporary path of the currently logged in user, and...
Microsoft Windows - MsiAdvertiseProduct Arbitrary File Copy/Read Exploit
Exploit for windows platform in category local exploits The bug is in “MsiAdvertiseProduct” Calling this function will result in a file copy by the installer service. This will copy an arbitrary file that we can control with the first parameter into c:\windows\installer … a check gets done while...
Ransomware Roundup: Attacking Shadow Copies Featuring Cryptowall
Ransomware is innovating to spread faster, hit harder and increase its payout potential. New unknown variants pop up daily, and many leverage non-malware techniques to evade traditional defenses. Cryptowall is a perfect example of how modern ransomware is evolving, using new techniques to disable...
In ExPetr/Petya’s shadow, FakeCry ransomware wave hits Ukraine
While the cyber-world was still shaking under the destructive ExPetr/Petya attack that hit on June 27, another ransomware attack targeting Ukraine at the same time went almost unnoticed. So far, all theories regarding the spread of ExPetr/Petya point into two directions: Distribution via trojaniz...
New Fileless Ransomware with Code Injection Ability Detected in the Wild
It is no secret that hackers and cybercriminals are becoming dramatically more adept, innovative, and stealthy with each passing day. While new forms of cybercrime are on the rise, traditional activities seem to be shifting towards more clandestine techniques that come with limitless attack vecto...
The Latest on WannaCry, UIWIX, EternalRocks and ShadowBrokers
Ransomware has gained global attention over the course of the last two weeks due to the huge spread of WannaCry. Following the initial attacks, we’ve seen UIWIX, Adylkuzz and now EternalRocks come onto the scene leveraging the same core set of vulnerabilities. The common thread between the three...
EUVD-2015-5275
The shadowcopy2getshadowcopydata function in modules/vfsshadowcopy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORYLIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy...
Insufficient Storage for VSS Error "0x8004231F or Error: VSSControl: -2147467259"
Challenge The following error occurs during a task that utilizes the Microsoft VSS subsystem: VSSControl: -2147467259 Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. VSS asynchronous operation is not completed. Operation: Shadow copies commit. Code:...
0x80042317 or Error: VSSControl: -2147212521
Challenge A task fails with the following error: Failed to prepare guest for hot backup. Error: VSSControl: -2147212521 Backup job failed. Discovery phase failed. Cannot add volumes to the snapshot set. Cannot add a volume to the snapshot set. Volume name:...
