This week, the SonicWall Capture Labs threat research team analyzed a ransomware that not only encrypts files but also accuses the victim of harboring explicit content on their computer and then threatens to turn it over to authorities if ransom is not paid.
Extortion attacks often come as unsolicited emails, and GoZone has stooped to pretending to find explicit content on victims’ machines to extract payment. This ransomware is written in Go. It is apparent that it uses Chacha20 and RSA encryption packages as evidenced by its strings.
Read more…
Source: SonicWall Capture Labs
Related:
- Hundreds of French supermarkets hit by cyberattack on refrigeration systems
October 12, 2026
Several supermarkets were forced to discard fresh and frozen food, Intermarché said, and have yet to estimate the losses. The Paris prosecutor has opened an investigation. Hundreds of French supermarkets belonging to the Intermarché and Coopérative U chains have fallen victim to a cyberattack targeting their refrigeration systems, the two retail giants said on Monday. Around 150 ...
- ‘123456’ password used in massive Danish CPR data breach
October 10, 2026
At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access to Denmark’s CPR register, Politiken reports. One of them was the company’s administrator ...
- Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
October 8, 2026
The credential-hijacking Shai-Hulud worm has struck again, this time burrowing its way into a popular AI agent platform SDK. Multiple security researchers reported Thursday that they had detected Shai-Hulud infection in a recent release of the npm package for version 0.5.144 of Tensorlake’s SDK. That package has somewhere in the neighborhood of 12,000 downloads per week, ...
- UK and Germany launch joint-partnership to counter sabotage and cyber attacks
October 8, 2026
Prime Minister Andy Burnham will travel to Berlin today for talks with Chancellor Friedrich Merz, as the UK and Germany work together on technologies and industries that will drive growth in every UK postcode, and build resilience against shared threats. The UK and Germany are Europe’s two largest economies and biggest investors in defence and today ...
- Attackers uses poem to infect thousands of servers with malware
October 8, 2026
Somewhere in the trackless wastes of cyberspace, a digital Robert Langdon is decoding an ancient poem to find the location of his masters and receive instructions on his next steps. I might be exaggerating a bit, but this is the gist of a rather bizarre story on cyberattacks and cryptocurrency mining. Cybersecurity researchers from Lumen’s Black ...
- Attackers hijack country-code domains to impersonate Google and other services
October 8, 2026
According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere. This wasn’t a break in encryption, ...