The Week in Ransomware - September 29th 2023 - Dark Angels - BleepingComputer
2023-09-29 17:30 (EST)
This week has been a busy ransomware week, with ransomware attacks having a massive impact on organizations and the fallout of the MOVEit breaches to be disclosed.
BleepingComputer also exclusively broke the story that building and automation giant Johnson Controls International suffered a Dark Angels ransomware attack, with the threat actors claiming to have stolen 27 TB of data from 25 file servers.
The cyberattack was reportedly launched in Asia offices, from which the threat actors spread to the rest of the corporate network. During this time, the attackers claim to have stolen DWG files, engineering documents, databases, confidential documents, and client contracts.
Soon after BleepingComputer broke the news, Johnson Controls submitted a FORM 8-K filing with the SEC, confirming they suffered a cyberattack.
We also continue to see the effects of Clops massive MOVEit data-theft attacks, with the National Student Clearinghouse warning of a data breach that impacted 890 schools and the BORN Ontario child registry breach impacting 3.4 million people, including patients at the Hospital for Sick Children (SickKids).
Cybersecurity firms, journalists, and law enforcement also released interesting reports this week:
Contributors and those who provided new ransomware information and stories this week include @serghei, @Ionut_Ilascu, @BleepinComputer, @fwosar, @Seifreed, @demonslay335, @billtoulas, @LawrenceAbrams, @malwrhunterteam, @MalGamy12, @billseagull, @coveware, @GroupIB_TI, @briankrebs, @pcrisk, @FBI, @jgreigj, and @DrWeb_antivirus.
September 23rd 2023
U.S. educational nonprofit National Student Clearinghouse (NSC) has disclosed a data breach affecting 890 schools using its services across the United States.
September 25th 2023
The Better Outcomes Registry & Network (BORN), a healthcare organization funded by the government of Ontario, has announced that it is among the victims of Clop ransomwares MOVEit hacking spree.
Technical writeup on Akiras new PowerRanges variant, internally called Megazord.
Megazord ransomware is a new variant of Akira ransomware. Akira ransomware appeared in March 2023, and a Linux version appeared in June. The encryption method is a combination of RSA + AES to encrypt files. Megazord ransomware is different from the previous one in that it is written in Rust language and uses a combination of curve25519 elliptic curve asymmetric encryption algorithm and sosemanuk symmetric encryption algorithm to encrypt. The suffix of the encrypted file is .powerranges, and it is also included in each folder. Drop a ransomware document.
PCrisk found new STOP ransomware variants that append the .azhi, .azqt, and .azop extensions.
PCrisk found a new Phobos ransomware variant that appends the .deep extension.
September 26th 2023
The Hospital for Sick Children, more commonly known as SickKids, is among healthcare providers that were impacted by the recent breach at BORN Ontario.
Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.
Hackers are actively exploiting a high-severity vulnerability in Openfire messaging servers to encrypt servers with ransomware and deploy cryptominers.
PCrisk found a new ransomware named Night Crow that appends the .NIGHT_CROW and drops a ransom note named NIGHT_CROW_RECOVERY.txt.
A logistics and training firm targeted by a "significant" cyber attack has entered administration.
September 27th 2023
Johnson Controls International has suffered what is described as a massive ransomware attack that encrypted many of the company devices, including VMware ESXi servers, impacting the company’s and its subsidiaries’ operations.
The victim shaming site operated by the Snatch ransomware group is leaking data about its true online location and internal operations, as well as the Internet addresses of its visitors, KrebsOnSecurity has found. The leaked data suggest that Snatch is one of several ransomware groups using paid ads on Google.com to trick people into installing malware disguised as popular free software, such as Microsoft Teams, Adobe Reader, Mozilla Thunderbird, and Discord.
PCrisk found a new Dharma variant that appends the .DOOK extension.
PCrisk found a new Xorist variant that appends the .Got extension.
PCrisk found new STOP ransomware variants that append the .mzhi, .mzop, and .mzqt extensions.
September 28th 2023
The FBI has warned about a new trend in ransomware attacks where multiple strains are deployed on victims networks to encrypt systems in under two days.
PCrisk found a new Medusa variant that appends the .meduza24 extension.
September 29th 2023
One of the largest healthcare systems in Michigan confirmed that it is dealing with a ransomware attack after a notorious hacker gang boasted about the incident.
PCrisk found a new ransomware variant that appends the .ELCTRONIC and drops a ransom note named README ELECTRONIC.txt.
Thats it for this week! Hope everyone has a nice weekend!
