Ransomware MegaCortex ataca empresas na Europa e América do Norte

especialistas da Sophos publicou um relatório, dedicados ao aumento da actividade de MegaCortex cryptographer.

This extortionist is orientated majorly of corporate sector and used in the carefully planned targeted attacks.

Tais incidentes são uma tendência real na última hora, e muitas grandes empresas sofreram ataques direcionados: it is worth remembering LockerGoga “heroic actions”. Its victim was one of the world’s main aluminum producers Norsk Hydro, and a series of big chemical enterprises.

Other threats that similar approach are Ryuk, BitPaymer, Dharma, Samsam e Matriz.

Sophos analysist said that megacortex was discovered in January 2019, when someone uploaded malware’s specimen on VirusTotal. Since that time number of attacks constantly grows: in total experts noted 76 incidents, com 47 deles (almost two thirds) occurred in the last week.

MegaCortex attacks affected companies in US, Canada, Netherlands, Ireland, Italy and France.

Cryptographers’ operators try as soon as possible to reach domain’s controllers and spread threat on as much systems as possible. “Recognize” MegaCortex is ealy due to extortionists’ message that can be seen below, or by changes files’ extensions as malware changes them on random sequence of eight symbols.

megacortex-ransom-note-black
Megacortex ransom note black

In the report Sophos researchers acknowledge that could not detect how extortionist gets on infected hosts. Por sua vez, IT-experts write in social networks that MegaCortex allegedly uses for it Rietpoof uploader. This is quite interesting observation as usually cryptographers get in networks through the brutforce of the poorly protected RDP-endpoints or as an payload of the second phase of the attack, just after infection of machines with fotografar ou trickbot Malware.

Recommendations on MegaCortex from Sophos specialists:

As the attack seems to indicate that an administrative password was abused by the criminals, we also recommend the widespread adoption of two-factor authentication for everything that currently requires just a password, and can use 2FA.

Keeping regular backups of your most important and current data on an offline storage device is the best way to avoid having to pay a ransom altogether.

Fonte: https://news.sophos.com

Sobre Trojan Killer

Carry Trojan Killer portátil em seu memory stick. Certifique-se que você é capaz de ajudar o seu PC resistir a quaisquer ameaças cibernéticas onde quer que vá.

Além disso, verifique

MageCart na Cloud Platform Heroku

Os investigadores encontraram vários MageCart Web Skimmers Em Heroku Cloud Platform

Pesquisadores da Malwarebytes informou sobre encontrar vários skimmers MageCart web na plataforma Heroku nuvem …

Android Spyware CallerSpy

máscaras spyware CallerSpy como uma aplicação de chat Android

Trend Micro especialistas descobriram a CallerSpy malwares, que mascara como uma aplicação de chat Android, …

Deixe uma resposta