security North Koreas' New Shinigami? - Ryuk Malware Makes Targeted Attacks

[rcmaehl]

Sources:

CheckPoint
BleepingComputer

 

TL;DR

Ransomware containing source code similarities to the Hermes malware created by the Lazarus that stole almost $1 billion from Bangladesh has suddenly spiked in Activity.

 

Media:

 

Quotes/Excerpts:

Quote

A new ransomware strain named Ryuk is making the rounds... the group behind it has already made over $640,000. Attacks with this ransomware strain were first spotted last Monday. Security researchers from various companies have not been successful at identifying how this ransomware spreads and infects victims. It seems the attacks are targeted, i.e. a result of some manual compromise. Reason for this is that the malware needs Admin privileges to run, which it doesn't achieve on its own. Something else that executes it had to achieve this privilege,... But no artifact was found. Ryuk may be the work of the same people who developed the Hermes ransomware. The connection between the two is pretty obvious... connections between past Hermes versions and current Ryuk samples, both of which shared large swaths of code. Ryuk's targeted nature is never more obvious than when it comes to its ransom notes. There seems to be some adaptation made in the ransom notes. As for the ransomware's encryption, this is a classic AES-RSA combo that's usually undecryptable unless the Ryuk team made mistakes... researchers have not spotted such weakness in Ryuk, as of yet. Unique Bitcoin payment addresses are created for each victim. The new Ryuk ransomware strain appears to be a new attempt from the Lazarus Group at developing a SamSam-like strain to use in precise surgical strikes against selected organizations.

 

My Thoughts:

While the normal person is unlikely to get infected with this it's interesting to see state sponsored malware in action. Like this Bagladesh malware it looks like this is nothing more than a money grab. With North Korea not having pretty much any exports, I'm not surprised.

[PlayStation 2]

tfw your country is so broke they have to resort to malware to steal money

[DildorTheDecent]

2 minutes ago, Dan Castellaneta said:

tfw your country is so broke they have to resort to malware to steal money

Maybe they said mean things about the Supreme Leader.

 

Never say mean things about the Supreme Leader.

[asus killer]

5 minutes ago, DildorTheDecent said:

Maybe they said mean things about the Supreme Leader.

 

Never say mean things about the Supreme Leader.

or he will remove your security clearence

[ItsMitch]

2 minutes ago, asus killer said:

or he will remove your security clearence

I can feel a strong case of Déjà vu

[TacoSenpai]

Oh shit my Death Note actually worked...

[GoldenLag]

2 minutes ago, LordOTaco said:

Oh shit my Death Note actually worked...

What did you write?  The North Korean economy?

 

Cuz it must have died hard resorting to this

[TacoSenpai]

Just now, GoldenLag said:

What did you write?  The North Korean economy?

 

Cuz it must have died hard resorting to this

Its a secret

[rcmaehl]

Just now, GoldenLag said:

What did you write?  The North Korean economy?

 

Cuz it must have died hard resorting to this

It was truly a Fire Sale

[GoodBytes]

Reminder to everyone:

• Windows 10 has ransomware protection via Windows Defender. It can lock all apps access to our personal folders, and only allow selected ones you pick (so add your programs).
• If you sync with OneDrive or Google Drive and they get infected, you can revert back the files in time. If you don't use OneDrive, see with your cloud drive of choice if it support this feature.
• Remember the 3x B's: Backup, Backup and Backup.

[TacoSenpai]

2 minutes ago, GoodBytes said:

Reminder to everyone:

• Windows 10 has ransomware protection via Windows Defender. It can lock all apps access to our personal folders, and only allow selected ones you pick (so add your programs).
• If you sync with OneDrive or Google Drive and they get infected, you can revert back the files in time. If you don't use OneDrive, see with your cloud drive of choice if it support this feature.
• Remember the 3x B's: Backup, Backup and Backup.

My biggest thing is to keep my external passport backup my important files on it and then keep it unplugged and locked in my fireproof safe

[rcmaehl]

24 minutes ago, GoodBytes said:

Reminder to everyone:

• Windows 10 has ransomware protection via Windows Defender. It can lock all apps access to our personal folders, and only allow selected ones you pick (so add your programs).
• If you sync with OneDrive or Google Drive and they get infected, you can revert back the files in time. If you don't use OneDrive, see with your cloud drive of choice if it support this feature.
• Remember the 3x B's: Backup, Backup and Backup.

Also:

 

3 Copies of the Data

2 Different storage types (internal, cloud, removable)

1 Copy of the 3 offsite

 

I'm currently only using 2-2-0, but I'm planning on changing that next tax season, or maybe I should look into Petabyte Project 2: Google Bugaloo myself since I'm approaching 8TB quickly (curse you 4k videos)

[Brooksie359]

1 hour ago, GoodBytes said:

Reminder to everyone:

• Windows 10 has ransomware protection via Windows Defender. It can lock all apps access to our personal folders, and only allow selected ones you pick (so add your programs).
• If you sync with OneDrive or Google Drive and they get infected, you can revert back the files in time. If you don't use OneDrive, see with your cloud drive of choice if it support this feature.
• Remember the 3x B's: Backup, Backup and Backup.

Honestly I don't have anything of real importance on my computer. If infected I would simply reformat the drive and call it a day. 

[asus killer]

3 hours ago, SC2Mitch said:

I can feel a strong case of Déjà vu

glitch in the Matrix?

[DaRk0]

12 hours ago, Dan Castellaneta said:

tfw your country is so broke they have to resort to malware to steal money

Better that than bombing countries, stealing their resources and killing countless civilian population in-between, like some of Western countries are doing. Amirite?

[PlayStation 2]

1 minute ago, DaRk0 said:

Better that than bombing countries, stealing their resources and killing countless civilian population in-between, like some of Western countries are doing. Amirite?

Oh, you mean Russia. I didn't know they were Western!

[DaRk0]

1 minute ago, Dan Castellaneta said:

Oh, you mean Russia. I didn't know they were Western!

Nope, I didn't mean Russia. I specifically said Western countries.

[PlayStation 2]

1 minute ago, DaRk0 said:

Nope, I didn't mean Russia. I specifically said Western countries.

Ah, right. You mean like a country that exports criminals, like Mexico.

This isn't an argument you're winning, mainly because you segwayed into it very poorly.

[DaRk0]

Just now, Dan Castellaneta said:

Ah, right. You mean like a country that exports criminals, like Mexico.

This isn't an argument you're winning, mainly because you segwayed into it very poorly.

It's not my intention to win any argument. I just need to look back to last 30 years, and see how many countries were destroyed by the west.