From December 2023 to the present, QiAnXin Threat Intelligence Center observed that a ransomware written in rust language is very active on the Chinese Internet, and a large number of machines in China have been ransomed, with up to more than 20 victimized units only in the terminals of government and enterprises, which the researchers call Rast ransomware.
After a long time of tracking, QiAnXin Threat Intelligence Center have captured three versions of Rast ransomware, and the versions are still iterating. rast ransomware has a very special logic: after the ransomware is completed, it will upload the machine name and unique identifier of the local machine to the remote mysql database. Through reverse analysis the research team got the mysql database account password and statistics of victims in the database, and found that in just ten months more than 6,800 terminals were controlled.
Read more…
Source: QiAnXin Threat Intelligence Center
Related:
- Statement of solidarity by the North Atlantic Council concerning the malicious cyber activities against the Czech Republic
May 27, 2025
“We stand in solidarity with the Czech Republic following the malicious cyber campaign against its Ministry of Foreign Affairs. We recognise that the Government of the Czech Republic has attributed the responsibility to the People’s Republic of China, specifically APT31, which is associated with the Ministry of State Security. This campaign targeted a Czech MFA unclassified ...
- Retail Under Siege: What Recent Cyber Attacks Tell Us About Today’s Threat Landscape
May 27, 2025
When several major UK organizations, including well-known retail brands, found themselves caught in a cyber attack earlier this year, it made headlines. But this incident wasn’t the first, and it won’t be the last. It reflects a growing trend where attackers exploit third-party vendors to breach multiple businesses through a single point of entry. In one ...
- Dutch authorities claim Russia-backed group hacked into networks of police and NATO
May 27, 2025
A previously unknown Russian hacking group was behind attacks last year on the networks of the Dutch police, NATO and several European countries, Dutch intelligence agencies said on Tuesday. The group, nicknamed Laundry Bear by the security agencies, was most likely supported by the Russian state, the Dutch General Intelligence Agency and Military Agency said in ...
- Pakistan among least affected by web threats
May 25, 2025
At its annual Cyber Security Weekend for the Middle East, Turkiye and Africa (META) region, the Kaspersky Global Research and Analysis Team presented cybersecurity trends, including ransomware, advanced persistent threats (APTs), supply chain attacks, mobile threats, artificial intelligence and IoT developments. The first quarter of 2025 showed that Turkiye and Kenya had the highest number of ...
- Adidas warns of consumer data breach
May 23, 2025
German sportswear maker Adidas said on Friday an unauthorised external party had obtained certain consumer data through a third-party customer service provider albeit not passwords or credit card data. “We immediately took steps to contain the incident and launched a comprehensive investigation, collaborating with leading information security experts,” the company said in a statement. Read more… Source: MSN ...
- Silent Ransom Group Targeting Law Firms
May 23, 2025
The cyber threat actor Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, is targeting law firms using information technology (IT) themed social engineering calls, and callback phishing emails, to gain remote access to systems or devices and steal sensitive data to extort the victims. While SRG has historically victimized companies in ...