Russian Ransomware Group REvil Back Online After 2-Month Hiatus

The operators behind the REvil ransomware-as-a-service RaaS staged a surprise return after a two-month hiatus following the widely publicized attack on technology services provider Kaseya on July 4. Two of the dark web portals, including the gang's Happy Blog data leak site and its...

REvil ransomware gang is back after disappearing amid Kaseya attack

By Waqas The official website of the REvil ransomware gang aka Sodinokibi which is accessible through the Tor browser is back online after going offline since July 2021. This is a post from HackRead.com Read the original post: REvil ransomware gang is back after disappearing amid Kaseya attack...

REvil gang hits UK ITSPs with series of extortion-based DDoS attacks

By Waqas Reportedly, the REvil ransomware gang is using DDoS attacks to make huge ransom demands from victim companies VoIP Unlimited and Voipfone. This is a post from HackRead.com Read the original post: REvil gang hits UK ITSPs with series of extortion-based DDoS attacks...

How to stay secure from ransomware attacks this Labor Day weekend

Labor Day weekend is just around the corner and, believe it or not, cybercriminals are likely just as excited as you are! Ransomware gangs have nurtured a nasty habit of starting their attacks at the least convenient times: When computers are idle, when employees who might notice a problem are ou...

Kaseya Issues Patches for Two New 0-Day Flaws Affecting Unitrends Servers

U.S. technology firm Kaseya has released security patches to address two zero-day vulnerabilities affecting its Unitrends enterprise backup and continuity solution that could result in privilege escalation and authenticated remote code execution. The two weaknesses are part of a trio of...

Kaseya’s ‘Master Key’ to REvil Attack Leaked Online

Someone has leaked the master decryption key that Kaseya used to unlock the files encrypted by a REvil ransomware attack on the company that affected customers across 22 countries last month. However, while the key may be interesting to security researchers, it’s not likely to be of use to any of...

Ransomware Gangs and the Name Game Distraction

Its nice when ransomware gangs have their bitcoin stolen, malware servers shut down, or are otherwise forced to disband. We hang on to these occasional victories because history tells us that most ransomware moneymaking collectives dont go away so much as reinvent themselves under a new name, wit...

A week in security (July 26 – August 1)

Last week on Malwarebytes Labs: OSX.XLoader hides little except its main purpose: What we learned in the installation process. The Clubhouse database “breach” is likely a non-breach. Here’s why. Kaseya Unitrends has unpatched vulnerabilities that could help attackers expand a breach. UDP Technolo...

2 new ransomware gangs Haron, BlackMatter appear after REvil, DarkSide

By Sudais Asif Currently, it is unclear if Haron and BlackMatter ransomware gangs have been started by now-defunct REvil and DarkSide ransomware operators. This is a post from HackRead.com Read the original post: 2 new ransomware gangs Haron, BlackMatter appear after REvil, DarkSide...

New Ransomware Gangs — Haron and BlackMatter — Emerge on Cybercrime Forums

Two new ransomware-as-service RaaS programs have appeared on the threat radar this month, with one group professing to be a successor to DarkSide and REvil, the two infamous ransomware syndicates that went off the grid following major attacks on Colonial Pipeline and Kaseya over the past few...

BlackMatter, a new ransomware group, claims link to DarkSide, REvil

Theres a new ransomware gang in town—and, frankly, were not at all surprised. After DarkSide disappeared—coincidentally, immediately after Colonial Pipeline gave in to the groups ransom demand of roughly $5M USD worth in Bitcoin—a new ransomware group who calls themselves BlackMatter surfaced on...

Three Zero-Day Bugs Plague Kaseya Unitrends Backup Servers

There are three new, unpatched zero-day vulnerabilities in Kaseya Unitrends that include remote code execution RCE and authenticated privilege escalation on the client-side. The Dutch Institute for Vulnerability Disclosure DIVD on Monday issued a public advisory warning that the service and clien...

Kaseya Obtains Universal Decryptor for REvil Ransomware

Kaseya has obtained a master decryptor key for the REvil ransomware that locked up the systems of at least 60 of its customers in a spate of worldwide cyberattacks on July 2. The attacks, which exploited now-patched zero-days in the Kaseya Virtual System/Server Administrator VSA platform, affecte...

Kaseya Gets Universal Decryptor to Help REvil Ransomware Victims

Nearly three weeks after Florida-based software vendor Kaseya was hit by a widespread supply-chain ransomware attack, the company on Thursday said it obtained a universal decryptor to unlock systems and help customers recover their data. "On July 21, Kaseya obtained a decryptor for victims of the...

What’s Next for REvil’s Victims?

Last week, the servers of ransomware giant REvil vanished. Many applauded as dark-web and clear-web sites used to support the backend infrastructure of REvil, aka Sodinokibi, as well as to leak victims’ data, slipped offline early Tuesday morning. Not REvil’s victims, though. They’re now stuck,...

Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins

Hello guys! The fourth episode of Last Week’s Security news, July 12 – July 18. I would like to start with some new public exploits. I think these 4 are the most interesting. If you remember, 2 weeks ago I mentioned the ForgeRock Access Manager and OpenAM vulnerability CVE-2021-35464. Now there i...

A week in security (July 12 – July 18)

Last week on Malwarebytes Labs: DNS-over-HTTPS takes another small step towards global domination Nope, that isn’t Elon Musk, and he isn’t offering a free Topmist Dust watch either Four in-the-wild exploits, 13 critical patches headline bumper Patch Tuesday Is crypto’s criminal rollercoaster...

“Seven or eight” zero-days: The failed race to fix Kaseya VSA, with Victor Gevers, Lock and Code S02E13

Kaseya VSA included at least “seven or eight” privately known zero-day vulnerabilities before it suffered a widespread ransomware attack that impacted hundreds of businesses, said Victor Gevers, chair of the Dutch Institute for Vulnerability Disclosure, or DIVD, a volunteer-run organization that...

Biden Puts a $10M Bounty on Foreign Hackers

Plus: REvil goes dark, spyware runs amok, and more of the week's top security news...

Linux Variant of HelloKitty Ransomware Targets VMware ESXi Servers

For the first time, researchers have publicly spotted a Linux encryptor used by the HelloKitty ransomware gang: the outfit behind the February attack on videogame developer CD Projekt Red. On Wednesday, MalwareHunterTeam disclosed its discovery of numerous Linux ELF-64 versions of the HelloKitty...