Attackers Behind Petya-Ransomware Emptying Bitcoin Wallet

The attackers behind Petya-ransomware have 9,000 euros paid by victims transferred to another bitcoin wallet. That leaves Aleks Gostev on Twitter know, chief security expert at anti-virus firm Kaspersky Lab. The ransomware which last Tuesday infected several organizations showed users see a screen where they were instructed to make about $ 300 to the specified bitcoin wallet.

Unlike many other ransomware became for all victims the same bitcoin wallet used. Last night decided the attackers 9,000 victims who had paid to worry about another wallet. In addition, there appeared on Pastebin message that bitcoin 100 (225 000 euro) were asked for the decryption key to decrypt all infected systems by Petya.

However, it is unclear whether the persons who placed the Pastebin message also behind the Petya-ransomware. According to researcher Matt Suiche attackers try to confuse the public by the story Petya actually a wiper which data could again turn into a story about ransomware, let him opposite Vice Magazine know.

2000 Sites Affected By Linux Ransomware

The ransomware that encrypts Linux web servers has already affected some 2,000 Web sites, but it is still unknown how systems get infected in the first place. Last week, reported the Russian anti-virus company Doctor Web that Linux ransomware had discovered.

The malware encrypted files and demanded one bitcoin, equivalent to 300 euros. The text file with instructions proved to be indexed by Google, so the number of affected sites could be mapped. Initially it went to a hundred websites, as shown by the Google search results. The Finnish anti-virus company F-Secure estimated, used on the basis of the bitcoin wallet that the ransomware that approximately 36 people of the requested ransom also had paid.

Now reports Doctor Web which now has around 2000 sites affected by the ransomware. This relates to WordPress websites and web shops running on Magento. The attackers know exactly how to enter, according to the virus fighter is not yet known.What is known is that it is still all about the first version of the Linux ransomware, which contains an error. This allows victims to free decrypt their data via a Bitdefender tool. Doctor Web warns that the chances are that the creators of the ransomware end up with a new version including all the problems are solved.

FBI Cyber Crime Forum Taken Offline Back Online

A popular forum for cyber criminals that two weeks ago by the FBI offline was removed has announced his comeback. In addition, the security will be tightened to thwart a new operation by investigators. Darkode the forum, according to the FBI an important place where criminals services, tools and exchange ideas to attack systems.

During an international operation where twenty countries participated were 70 Darkode members arrested, indicted or are still being sought. Including a trainee of security FireEye was arrested for activities at the forum. It was about to take offline a forum for cyber criminals largest international operation of investigative services.

Rentree

But the forum's administrator was not arrested and has now announced the comeback of Darkode. According to the administrator is the largest part of the administrators and other senior members are not picked up. The operation of the investigators would focus on new members or people who have long been nothing more with the "scene" had to do. The new version of Darkode will again be hosted through the Tor network and are by invitation only.

In addition, each member will receive their own onion address to visit the website. Thus have visited the administrators more control over who the website and offers more log information to identify informants for example. In addition, a user of the bitcoin-wallet will be linked to his account. Even if the user's account was hacked, an attacker can not use the account unless the private key of the user bitcoin wallet knows, reports Malware Tech .