Recent Adobe Flash Player Vulnerability Leak Attacked Via Exploit Kits

A recently patched vulnerability in Adobe Flash Player is being actively attacked via exploit kits. This means that visiting a hacked website or seeing infected ads with a vulnerable Flash Player version is sufficient to infect with malware.

The vulnerability in question was resolved by Adobe on February 6 through an emergency patch . The vulnerability appeared to have been targeted against South Korean organizations since last November . Here Excel and Word files with embedded Flash objects were used. Now it appears that cyber criminals also have the exploit to use them via the web.

Flash Player was and still is the most popular target for exploit kits. Due to the absence of new exploits, and the fact that more and more browsers are phasing out the support of Flash Player, the effectiveness of exploit kits has declined sharply in the past period . According to researcher Kaffeine of the Malware do not need coffee blog , this is the first new Flash exploit that has been added to an exploit kit since July 2016 for a Flash leak. The new Flash exploit will be deployed via infected ads and will successfully install the Hermes ransomware. Users are therefore advised to upgrade to Flash Player version 28.0.0.161 or later, as the vulnerability has been corrected.

New Version Tesla Crypt Spotted In The Wild

There's a new version around the stubborn ransomware trojan Tesla Crypt. Although not much seems to have renewed the software, it is very difficult for them to komen.De off new variant, Tesla Crypt v2.2.0, encrypts files with the .ccc file extension, such as happened in previous versions.

What is new is that there are multiple names for ransom notification files. According to posts on forums that filename can vary and it looks like "_how_recover_.HTML 'or' _how_recover_.TXT.

The ransomware Crypt Tesla earlier this year for the first time discovered and has targeted files with extensions which had mainly to do with games. To regain access to the files, often $ 500 was demanded.

According Bleepingcomputer it is virtually impossible to undo the encryption of Tesla Crypt v2.2.0 without paying the cyber criminals. Because version 1 yet made ​​use of a symmetric encryption method, soon developed a tool to "liberate" hostage files without paying. This new variant is working tool which unfortunately no longer.

Barber Pays 1000 Euros After Ransomware Infection

A Scottish hairdresser has been the victim of ransomware, with a database containing customer data was encrypted. Despite paying 1000 euro ransom turned out to be a big part of the corrupted files, making the barber customer contact information and other information is lost.

Exactly how the attack took place late hairdresser Ellen Conlin Hair & Beauty not know in Glasgow. According to the Evening Times the attackers would not only have encrypted the company database, but also important information have been removed. The attack occurred exactly is unclear. However, the attack would hairdresser possibly thousands of euros because of missed appointments can cost. The attacked systems contained appointments, salary information, customer history, shares information and marketing data.

The salon now considering suing the developer and supplier of the software. "I pay them to store my information safe," said the owner of the salon which has about 3,000 members. He gave the supplier the order to pay the ransom. It was only $ 350, but was increased to 1,000 euros. Eventually, the attackers sent a decryption key, but it did not work properly. A large part of the information was corrupted. Therefore the company has lost more than a year of important data.

FBI Denies Payment Advice To Ransomware Victims

The FBI provides victims of ransomware no advice to pay the demanded ransom, as has informed the American investigative know. Last week, an FBI agent in the news which said that paying the FBI ransomware victims regularly advises.

"Ransomware is so good," said FBI agent Joseph Bonavolonta. "To be honest, we often advise people to pay the ransom."A spokesman for the FBI late to anti-virus firm Sophos know that the investigative makes no recommendations to companies. However, the FBI puts the opportunities to affected companies. "It is up to the companies to decide what is the best solution for them. That is whether to restore backups, access a security professional or pay."

It also asked whether victims have to pay or not. In this case pointed to a website that recommends not to pay. According to Paul Ducklin of Sophos, people and enforcement agencies simply talk if it is not about their data. He also states that pay quite okay, but that appearance is preferred.

FBI Recommends Ransomware Victims To Pay

The FBI regularly advises victims of ransomware to pay the ransom so that they recover their files. Ransomware is still a major problem in the United States. In June, let the FBI know that between April 2014 and June this year had received 992 complaints about the CryptoWall-ransomware. Victims should by the malware 18 million dollars have been lost.

Victims of ransomware are advised to contact the FBI, but the US detection can often advise his little else to pay if companies want their data. "Ransomware is so good," said FBI agent Joseph Bonavolonta. "To be honest, we often advise people to pay the ransom." That left Bonavolonta during Cyber ​​Security Summit 2015 in Boston know, reports The Security Ledger.

"The easiest way is to pay the ransom," as the FBI agent added. According Bonavolonta are attempts by the FBI and others to crack the encryption of the ransomware not been successful. "The amount of money that these criminals get inside is huge and that's because the vast majority of institutions pay the ransom." Earlier this year, also left the British anti-virus firm Sophos know that paying ransomware in some cases the only solution is.

A recommendation which earlier also by the Computer Emergency Readiness Team of the US Government (US-CERT) was given.

Cisco Disrupts Extensive Network Of Cyber Criminals

Network manufacturer Cisco has disrupted an extensive exploit kit network that criminals tried to infect surfers with ransomware and other malware. How many people have been victimized and how many criminals have earned the ransomware is unknown.

The action was directed against the Cisco Angler-exploitkit, used by cyber criminals to infect Internet users via vulnerabilities in Adobe Flash Player, Silverlight and Internet Explorer with malware. Cisco researchers discovered that the Angler-exploitkit used a large number of proxy servers, which were located primarily in the provider Limestone Networks. The study showed that the Angler-exploitkit one party was used extensively. This party was for 50% of all activity of the Angler exploit responsible and tried every day 90,000 people to infect via the aforementioned vulnerabilities.

Infections can only occur when users are using vulnerable software, for example, because they have no security updates have been installed. By working with Limestone was extensive information about the Angler-exploitkit are collected.Eventually all hosting providers where the proxy servers were informed, who then Switch off servers. Therefore, the cyber criminals had no access to the Angler-exploitkit.

Juggling With Figures

Cisco sets the announcement about the operation that cyber criminals through the exploitkit $ 60 million per year earned by ransomware. It is important to mention that this is an assumption and not a fixed amount. There is no hard evidence how many criminals have earned through their ransomware. The estimate of Cisco is based on several assumptions. For example, pointed to previous research showing that 40% of Internet users being attacked via the Angler-exploitkit also touches actually infected.

Further, it would be installed in 62% of infections via Angler ransomware. In addition, the average ransomware amount would be $ 300. According to figures from Symantec would actually pay 2.9% of the victims. Because all that matters to multiply with each Cisco eventually comes to an amount of 60 million dollars. As stated, this is an unconfirmed amount based on certain assumptions.

Thus, researchers from Dell SecureWorks to 0.4% of the ransomware victims pay the demanded ransom. Other studies a percentage of 0.27% to the front. If Cisco with these percentages, the amount would have expected would be much lower outage, which includes fluctuations in the number of successful infections and the number of ransomware installations.

Ransomware Encrypts Servers Australian Sex Shop

Not only hospitals and writers are at risk to be affected by ransomware, also need to be careful sex shops. The owner of the oldest sex shop in the Australian state of Queensland last Friday hit by ransomware which are encrypted servers.

Only when three bitcoins were paid, what with the current exchange rate is about 600 euros, the encrypted data could be decrypted again. "I have to pay, I have no choice, these hackers can get all of our servers, including customer data," says owner Colin Edwards. "If we would try to gain access to our system, they have threatened to destroy it." How computers were infected, the shop owner does not know.

Edwards feels particularly let down by the police. Cops let him know nothing they could do and asked him to make online declaration. "We got an email back that they were very busy and could not tell if they contact," so let him across News Limited know. What customer data are exactly on the servers Edwards has not made ​​clear. Because of the infection, the online store of the sex shop offline.

Thousands Of Hacked WordPress Sites Spread Malware

Attackers have managed to hack thousands of WordPress sites and use them for distributing malware, including the website of a US security. Before that warns security firm Sucuri. It would now go to 6,000 contaminated sites.

The attacks on the WordPress websites began two weeks ago. The hacked sites placed code that visitors unnoticed a page with the Nuclear-exploitkit late charge. This exploitkit is using known vulnerabilities in Adobe Flash Player and Internet Explorer users have not patched. Among the hacked WordPress sites are among other Coverity's website, a company dealing with security software.

How the attackers access to the WordPress sites managed to get has not been determined yet, but the attackers seem to create vulnerabilities in WordPress plugins use. Not just forget owners of WordPress flocking to update the software on their website, including updates to installed plug-ins will be forgotten. According to figures from W3Techs is WordPress by 24.4% of all websites on the Internet use.

Ransomware Encrypts Network Hospital US

Thousands of workers of an American hospital five days can make use of an important network because some files were encrypted by ransomware. Because of the infection, it was decided to remove the network from the air.

The network is used by more than 4,000 employees at the James A. Haley Veterans' Hospital in Florida. "Some documents were infected on the shared drive and left an alarm," a spokeswoman told the Tampa Tribune. "This could affect all employees with computer access, more than 4,000 people." The damage is now mapped. All files on the network, there was a back-up, according to the spokeswoman. How ransomware could spread on the hospital network was not disclosed.

WordPress Vulnerabilities Take Over Attacker's Website

The administrators of WordPress have released a security update for the content management system which fixes three vulnerabilities. Through the vulnerabilities an attacker could take over the website, as reported to the Computer Emergency Readiness Team of the US government.

These include two cross-site scripting vulnerabilities and a leak that allows users without sufficient rights privépostings could publish and could make sticky. Furthermore there are 26 non-security-related bug fixes. Users are advised to go to WordPress 4.3.1 upgrade. According to figures from W3Techs is WordPress by 24.4% of all websites on the Internet use.Recently, it was revealed that millions of websites who use WordPress running a vulnerable version. This means they can be hacked and used to spread malware.

Microsoft Checks On Millions Of Computers Ransomware

Since yesterday evening, Microsoft has millions of Windows computers on the presence of an active ransomware family-controlled. It involves the Teerac-ransomware, which has been active since early 2014. In recent months, hundreds of thousands of computers with ransomware in touch.

These are essentially computers in Australia, Germany and Turkey. Teerac spreads via email attachments. When a user opens the attachment kinds of files are encrypted and there should be a fee of $ 500 in bitcoin paid to recover the files.According to Microsoft appear every day new instances of ransomware to avoid being detected by anti-virus software.

Due to the increasing activity of Teerac decided the Microsoft Malicious Software Removal Tool (MSRT) update in Windows so that the program can recognize and remove ransomware. The MSRT is a removal tool which is updated every month with new virus definitions and then scan the computer. In the case of an infection, the malware found is then removed. According to Microsoft, prevention is better than cure. Users also are advised to make backups, to keep software up to date, use a pop-up blocker and not to open attachments from strangers.

Millions Of WordPress Websites Vulnerable To Hackers

WordPress is by far the most popular content management system (CMS) on the Internet, but many administrators forget to update the software or use vulnerable plug-ins, allowing millions of websites are at risk of being taken over. The Danish security Heimdal Security warns that the looks of hacked WordPress websites that distribute ransomware on the rise.

The websites are malicious code placed that visitors unnoticed to a page with the Neutrino-exploitkit. This exploitkit uses known vulnerabilities in Adobe Flash Player, Adobe Reader and Internet Explorer users have not patched. In case the attack is successful, the Tesla Crypt-ransomware placed on the computer, mainly computer games-related data encrypted. Next, there to decrypt the files to be paid.

According to figures from W3Techs is WordPress by 24.4% of all websites on the Internet use. The latest WordPress version 4. This version is used by 79.9% of WordPress sites. 20.1% running on WordPress version 3 or older. The latest version of WordPress 3 appeared on November 20, 2014 and fixed it several security vulnerabilities. Also, version 4 have been different versions appeared, in part because of vulnerabilities.

In the 79.9% which WordPress uses 4 can therefore which users are still running a vulnerable version. Each month WordPress websites are 409 million people read. According Heimdal Security is therefore important that WordPress administrators to install available updates, both for their own website as the safety of their visitors.

Thousands Of Hacked WordPress Sites Spread Ransomware

In recent weeks attackers have hacked more than 2600 unique WordPress sites and provide malicious code that attempt to infect visitors with ransomware. The hacked WordPress sites are all running version 4.2 of the software or older, says security firm Zscaler.

The attack on the WordPress sites consists of several steps. First, the site is accepted in full. So the attackers add a Webshell, and steal the credentials of the administrator. Is then added an iframe to the website that visitors to the WordPress site unnoticed a page with the Neutrino-exploitkit late charge. The iframe code only to users of Internet Explorer is shown. A cookie will prevent victims of the iframe code are offered several times.

To infect users makes the Neutrino-exploitkit using a malicious Flash file. In case Flash Player not installed on the computer, the user is offered an old Flash installation file, and the malicious file is loaded. Do not know how the installer will install exactly Zscaler allows the analysis of the attack.

In case the attack is successful, the ransomware CryptoWall-installed on the computer. This ransomware encrypts files on the computer and asks users a certain amount for decrypting. According to analyst John Mancuso WordPress remains an attractive target for cyber criminals. WordPress is a very popular free content management system used by more than 60 million websites, including about 23% of the Top 10 million websites on the internet.

American Town Pays Twice Ransom To Ransomware

A town in the US state of New York last year twice in a short time become a victim of ransomware. And twice it was decided to pay the ransom. It went together to the tune of $ 800. The infections were carried out in Ilion, which consists of 8,000 inhabitants.

The malware was spreading in both cases via e-mail attachments and encrypted both payroll and accounting systems, as the mayor opposite let NBC know. The infections, which occurred in January and May, were reported ( pdf ) by the Office of the State Comptroller. "These incidents are a wake-up call for local governments in the state," as late Comptroller Thomas DiNapoli know. "Although the amount of money was low and no vital information was leaked, this attack does show that lack of standard IT security taxpayers expense can hunt and functioning of cities and school districts can disrupt."

Canada

The problem of ransomware plays not only in the United States. Recently, also various systems of two Canadian towns hit by ransomware. When the infection in Mahone Bay were encrypted files back to 2007. An officer received an email supposedly a resume. The enclosed zip file appeared to be the CryptoWall-ransomware. Since the malware no important data encrypted was not proceeded to pay.

In the case of the infection in the Canadian Bridgewater would even talk of two ransomware specimens have been, namely CryptoWall and Crypto Locker, let the Chief Administrative Officer of the city across from CBC News to know. Also in this case would no important files are encrypted there and the ransom was not paid. To prevent a new infection is now controlled security against ransomware and henceforth be made ​​offline backups.

"Victim" Ransomware Receive Discounts Of Cybercriminal

Researchers have discovered a ransomware variant of which the author communicates via e-mail with victims and open to give off the ransom. The Troldesh-ransomware is spreading via email and ransomware encrypts like other kinds of files on the computer.

Remarkably, the ransomware also encrypts the file names. What is also striking is that Troldesh victims asked to contact via e-mail to decrypt the files and the payment method to use. Natalia Kolesova, researcher at security firm Check Point , decided an e-mail to the ransomware maker. She received within a few minutes an e-mail with instructions. To regain her files she had to send an encrypted file and pay 250 euros.

Then she asked in a subsequent email to discount, which ransomware maker had removed 15% of the amount. Eventually knows Kolesova get 50% off the ransom, which the author reports that the decryption key will not be given for free. "By the end of our correspondence I had received a 50% discount. Maybe if I had gone to negotiate even I could get a bigger discount," she noted. Recently, there was the creator of another ransomware copy which 'm vindicated and all infected computers decided to decrypt charge.

Virustotal Link

Android Ransomware Not Give Paying User Penalty

Last week, more than 15,000 e-mails are sent with Android ransomware that occurs when a security update for Adobe Flash Player. The messages contain little text, except that the enclosed APK file, "Check Updates.apk" is an update to Flash Player.

In reality, it is ransomware that locks the device and a warning from the FBI shows. According to the warning, the user would have viewed pornographic websites. To unlock the device must be an amount of $ 500 to be paid. If the user attempts to unlock the device, the amount is increased to $ 1,500, reports the Romanian antivirus company BitDefender .

According to the Spanish security company S21sec ransomware makers find new ways to spread their creations. Currently used mainly social engineering, but new capabilities are added continuously, according to the IT security officer. Users also are advised to install APK files from untrusted sources and email filtering with MOT attachments.

Victims Ransomware In Conversation With Extortionists

Globally, still a large number of people and organizations affected by ransomware, the infection can sometimes have serious consequences for their lives and business, says FireEye. The US security was given access to the conversations between the victims and the makers of the Tesla Crypt-ransomware.

Within three months, the creators managed to extort about 67,000 euros from 163 victims, which amounts to about 410 euros per victim. There was also a victim who paid 875 euros. It turned out 13% of the victims to make the requested amount.Tesla Crypt offers an online chat functionality, the victim may ask the makers about paying via bitcoin. Therefore also the effect of ransomware on the lives of the victims clearly.

The victims were scattered around the world, students in Iran and Spain to people in the United States, Germany, Argentina, Croatia and Mongolia. Some were afraid that they would be expelled from school or dismissal by their employer if they would follow the files were not returned. Fathers and mothers were torn apart by the loss of their family photos.

Several organizations were targeted, including an organization that conducts research into blood cancers. According FireEye many of the victims are not able to pay the amount requested and then gave up. Below is a portion of the chat conversations where the security given access.

TorLocker-Ransomware By Mistake Decrypt Free

For several months, a new ransomware copy active TorLocker called, but by the fault of the author shows that stocks in more than 70% of cases are free to decrypt. TorLocker , also called "scraper", was the First discovered in late October last year.

Like other forms of crypto TorLocker ransomware encrypts all kinds of files on the computer and connected network drives for ransom. This keeps the ransomware account files that are larger and smaller than 512MB. Is a file larger than 512MB, then only the first 512MB of encrypted file. Also, all system restore points are removed and the ransomware sets a background with instructions how to decrypt the files. For this, the victim, a sum of $ 300 or more payments in bitcoins.

To encrypt TorLocker makes use of AES and RSA encryption. A bug in the implementation is the encryption in more than 70% of the cases to undo without victims must pay for this, says the Russian anti-virus firm Kaspersky Lab. The virus fighter developed a free tool that allows free access to the bulk of their encrypted files can decrypt. Last year also several ransomware variants discovered which were free by a programming error to decrypt.

Ransomware Steals For The First Time Passwords

Researchers have for the first time discovered a ransomware variant installs simultaneously spyware to steal all kinds of passwords from the system. According to the Japanese anti-virus company Trend Micro is the first time that ransomware is bundled with spyware. However, the infection method of "CryptoWall 3.0" is equivalent to previous versions and other crypto ransomware.

Users receive an e-mail with a zip annex, which would contain a so-called CV. In reality it is a Javascript file. Once the user opens this file are downloaded two "JPG files." However, the extension is only intended to circumvent security systems.Once the files are downloaded performed by JavaScript. It is a variant of CryptoWall and Fareit spyware. CryptoWall encrypts all kinds of data on the computer and then asks for a sum of 500 euros to decrypt it.

Is not paid on time, then the user must pay 1,000 euros. While the user is thus inferred Fare it steal all types of passwords from FTP programs, browsers, email clients and bitcoin wallets says analyst Anthony Joe Melgarejo. He argues that there are several reasons why the spyware is bundled with ransomware, perhaps because people refuse to pay the ransom and thereby steal passwords is a backup plan. "

Even if the user refuses to pay would be the cyber criminals, for example via the passwords of the bitcoin wallets, still can steal money. To infections with these and other species to prevent ransomware, users advised to not open attachments from unknown senders. "In fact, they should ignore or delete e-mail from unknown senders," says Melgarejo.