The Week in Ransomware - January 14th 2022

January 8th 2022

Source: https://www.bleepingcomputer.com/

New Wasp Ransomware

dnwls0719 found the new Wasp Ransomware that appends the .0.locked extension to encrypted files.

Wasp Ransomware

January 10th 2022

Linux version of AvosLocker ransomware targets VMware ESXi servers

AvosLocker is the latest ransomware gang that has added support for encrypting Linux systems to its recent malware variants, specifically targeting VMware ESXi virtual machines.

FinalSite: No school data stolen in ransomware attack behind site outages

FinalSite announced today the findings of a six-day investigation into last week's ransomware attack, stating it found no evidence schools' data accessed or stolen by hackers.

New STOP Ransomware variant

Jakub Kroustek found a new STOP ransomware variant that appends the .nqhd extension.

January 11th 2022

Night Sky ransomware uses Log4j bug to hack VMware Horizon servers

The Night Sky ransomware gang has started to exploit the critical CVE-2021-44228 vulnerability in the Log4j logging library, also known as Log4Shell, to gain access to VMware Horizon systems.

January 12th 2022

Source: https://www.bleepingcomputer.com/

Magniber ransomware using signed APPX files to infect systems

The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.

TellYouThePass ransomware returns as a cross-platform Golang threat

TellYouThePass ransomware has re-emerged as a Golang-compiled malware, making it easier to target more operating systems, macOS and Linux, in particular.

School’s out as cyberattack forces APS to cancel classes

A cyberattack against Albuquerque Public Schools prompted the state’s largest district to cancel all classes districtwide on Thursday and possibly Friday.

New STOP ransomware variant

PCrisk found a new STOP ransomware variant that appends the .zaqi extension to encrypted files.

January 13th 2022

Ukranian police arrests ransomware gang that hit over 50 firms

Ukrainian police officers have arrested a ransomware affiliate group responsible for attacking at least 50 companies in the U.S. and Europe.

January 14th 2022

Russia arrests REvil ransomware gang members, seize $6.6 million

The Federal Security Service (FSB) of the Russian Federation says that they shut down the REvil ransomware gang after U.S. authorities reported on the leader.