The Week in Ransomware - March 4th 2022

Source: https://www.bleepingcomputer.com/

February 27th 2022

Conti ransomware's internal chats leaked after siding with Russia

A Ukrainian security researcher has leaked over 60,000 internal messages belonging to the Conti ransomware operation after the gang sided with Russia over the invasion of Ukraine.

February 28th 2022

Microsoft: Ukraine hit with FoxBlade malware hours before invasion

Microsoft said that Ukrainian networks were targeted with recently found malware several hours before Russia's invasion of Ukraine on February 24th.

Toyota halts production after reported cyberattack on supplier

Japanese automaker Toyota Motors has announced that it stopped car production operations. The outage was forced by a system failure at one of its suppliers of vital parts, Kojima Industries, which reportedly suffered a cyberattack.

Insurance giant AON hit by a cyberattack over the weekend

Professional services and insurance giant AON has suffered a cyberattack that impacted a "limited" number of systems.

New Dharma Ransomware variant

PCrisk found a new Dharma ransomware variant that appends the .xgpr extension.

New STOP Ransomware variants

PCrisk found new STOP ransomware variants that append the .fgnh and .fgui extensions.

March 1st 2022

Decryptable PartyTicket Ransomware Reportedly Targeting Ukrainian Entities

Analysis of the PartyTicket ransomware indicates it superficially encrypts files and does not properly initialize the encryption key, making the encrypted file with the associated .encryptedJB extension recoverable.

Conti Ransomware source code leaked by Ukrainian researcher

A Ukrainian researcher continues to deal devastating blows to the Conti ransomware operation, leaking further internal conversations, as well as the source for their ransomware, administrative panels, and more.

Stormous ransomware gang sides with Russia

STORMOUS ransomware gang has officially announced its support for the Russian governments.

Conti Ransomware Group Diaries, Part I: Evasion

The chat logs offer a fascinating glimpse into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. The records also provide insight into how Conti has dealt with its own internal breaches and attacks from private security firms and foreign governments.

New STOP Ransomware variant

PCrisk found a new STOP ransomware variant that appends the .sdjm extension.

March 2nd 2022

Conti Ransomware Group Diaries, Part II: The Office

In Part II of this series we’ll explore what it’s like to work for Conti, as described by the Conti employees themselves.

New Phobos Ransomware variant

PCrisk found a new Phobos ransomware variant that appends the .DIKE extension.

MAPPING THE CONTI NETWORK

A network relationship map, showing the relationships between users, based on the leaked Conti chat logs.

March 3rd 2022

Free decryptor released for HermeticRansom victims in Ukraine

Avast has released a decryptor for the HermeticRansom ransomware strain used in targeted attacks against Ukrainian systems over the past ten days.

New STOP Ransomware variant

PCrisk found a new Phobos ransomware variant that appends the .iiof extension.

March 4th 2022

New STOP Ransomware variant

PCrisk found a new Phobos ransomware variant that appends the .vyia extension.