Huis » Nieuws » Onderzoekers zeggen over het kweken van activiteit van TFlower, andere ransomware dat RDP gebruikt

Onderzoekers zeggen over het kweken van activiteit van TFlower, andere ransomware dat RDP gebruikt

Volgens Bleeping Computer, de activiteit van TFlower, a ransomware that uses RDP and is focused on corporate networks, has begun to gain momentum.

The malware arrived in late July and installs into the system after a hacker attack aimed gaining access to the Remote Desktop service.

“With the huge payments being earned by ransomware developers as they target businesses and government agencies, it is not surprising to see new ransomware being developed to take advantage of this surge in high ransoms. Such is the case with the TFlower ransomware”, - verslag doen van Bleeping Computer journalists.

Momenteel, TFlower is distributed to victims as a chilli.exe file and encrypts data using the AES algorithm in CBC mode. It also able to remove shadow copies of Windows, disable the recovery tools for Windows 10 and force shut down the Outlook.exe process to get to its files.

The malware encryption process displays in the console; and having started this task, it connects to the control center and updates his status. Searching and converting the victim’s files, TFlower bypasses the Windows folder and the “Samples of music” (plaats – C:\Users\Public\Public Music\Sample Music).

The rookie does not have his own extension for encrypted files, he only adds the *tflower token and the encryption key to them. After completing its work, the malware reports this to the C&C server, and on the infected machine messages appear asking for ransom !_Notice_!.tekstin all folders with modified files and on the desktop.

For instructions on recovering files, ransomware offers to contact them by email using @protonmail.com or @tutanota.com.

LEZEN  .Docm Ransomware Info

When TFlower debuted, its overlords charged 15 bitcoins per decryption key. Since the end of August, they ceased to indicate the size of the ransom in their messages. It is currently impossible to return files without paying a ransom: analysts are studying malicious code, but have not yet discovered vulnerabilities in the encryption system.

Internet-accessible RDP services as an attack vector are very popular with distributors of encryption programs targeting corporate environment. SamSam, Scarabey, Matrix, Dharma and Nemty dit jaar, used a similar method of infection.

[Totaal: 0    Gemiddelde: 0/5]

Over Trojan Killer

Carry Trojan Killer Portable op je memory stick. Zorg ervoor dat u in staat om uw pc te weerstaan ​​elke cyberdreigingen overal mee naar toe bent.

Controleer ook

ERosary smart rozenkrans kwetsbaarheden

Onderzoekers vinden kwetsbaarheden in eRosary smart rozenkransen van Vaticaanstad ontwikkelaars

Onderzoekers vinden kwetsbaarheden in de eRosary smart rozenkrans, die het Vaticaan ontwikkelaars eerder had ingevoerd. …

Werd verwijderen Virus Ransomware (+Bestandherstel)

Inhoudsopgave Over WerdDo geen geld voor decoderen van te verzenden “werd” bestanden!Hoe te beschermen …

Laat een antwoord achter