This week, the SonicWall Capture Labs threat research team analyzed a ransomware that not only encrypts files but also accuses the victim of harboring explicit content on their computer and then threatens to turn it over to authorities if ransom is not paid.
Extortion attacks often come as unsolicited emails, and GoZone has stooped to pretending to find explicit content on victims’ machines to extract payment. This ransomware is written in Go. It is apparent that it uses Chacha20 and RSA encryption packages as evidenced by its strings.
Read more…
Source: SonicWall Capture Labs
Related:
- A Closer Look at APT Group Sofacy’s Latest Targets
March 23, 2018
Threatpost talks to Kaspersky Lab researcher Kurt Baumgartner who was instrumental in tracking the latest activities of the Russian-speaking Sofacy APT gang. Research shows a continual march toward Far East targets and overlapping of activities with other groups such as Lamberts, Turla and Danti. Baumgartner, a researcher with Kaspersky Lab’s Global Research and Analysis Team, presented his ...
- Website of Russian MoD Hit by DDoS Attacks From Western Europe, North America
March 22, 2018
The Russian Defense Ministry said a total of 7 denial-of-service (DDoS) attacks were carried out against its website on Thursday during the final vote on the names of new types of weaponry. “The site of the Russian Defense Ministry during the final vote for the names of the newest domestic weapons was subjected to a massive DDoS attack,” the ministry stated. The ...
- Old banking Trojan TrickBot has been taught new tricks
March 22, 2018
The TrickBot Trojan has been upgraded with new modules to make detection, and defense, more difficult. First discovered in 2016, TrickBot is a financial Trojan which targets the customers of major banks. The Trojan is most commonly connected to phishing campaigns which trick users into entering their credentials into phishing and fraudulent banking websites, designed to appear as legitimate ...
- Cryptocurrency Miner Distributed via PHP Weathermap Vulnerability, Targets Linux Servers
March 21, 2018
Legitimate and large-scale cryptocurrency mining operations often invest in dedicated hardware and electric consumption to make a profit. This doesn’t escape the attention of cybercriminals: Malicious cryptocurrency mining was so pervasive last year that it was the most detected network event in devices connected to home routers. Through our incident response-related monitoring, we observed intrusion attempts whose indicators we’ve been able to ...
- ManageEngine zero-day vulnerabilities impact three out of five Fortune 500’s
March 21, 2018
Severe zero-day vulnerabilities have been discovered in ManageEngine products used by a substantial number of Fortune 500 companies. On Wednesday, researchers from Digital Defense disclosed the bugs, discovered by the firm’s Vulnerability Research Team (VRT). In a security advisory, the team said that six previously unknown vulnerabilities impact three ManageEngine products, Logs360, EventLog Analyzer and Applications Manager. Read more… Source: ZDNet
- Expedia’s Orbitz Says 880,000 Payment Cards Compromised in Security Breach
March 20, 2018
Chicago-based online travel booking company Orbitz, a subsidiary of Expedia, reveals that one of its old websites has been hacked, exposing nearly 880,000 payment card numbers of the people who made purchases online. The data breach incident, which was detected earlier this month, likely took place somewhere between October 2016 and December 2017, potentially exposing customers’ ...