Gigamit sa Evil Corp ang bag-ong Macaw malware alang sa mga pag-atake sa ransomware

The hack group Evil Corp (aka Indrik Spider and Dridex) began using the new Macaw Locker (or simply Macaw) malware for attacks. Experts attribute this to US sanctions, which do not allow victims to pay ransoms to attackers.

Researchers remind that Evil Corp has existed since at least 2007, but at first hackers more often acted as partners of other groups. Only later did Evil Corp begin to focus on its own attacks, creating the well-known banking Trojan Dridex.

Over time, as ransomware attacks began to generate more revenue, Evil Corp launched its own ransomware BitPaymer, delivering it to victimsmachines via Dridex. The latter gradually evolved from a common banker into a complex and multifunctional tool.

Eventually, the group’s activities attracted the attention of the American authorities. In 2019, the US authorities brought charges against two Russians who, according to law enforcement officials, were behind the development of Dridex malware and other malicious operations. Usab, the US authorities imposed sanctions on 24 organizations and individuals associated with Evil Corp and the mentioned suspects.

As a result, negotiating companies, which usually negotiate ransom payments and decryption of data with extortionists, refused toworkwith Evil Corp to avoid fines and lawsuits from the US Treasury Department.

In response, Evil Corp began renaming its ransomware and masking operations to avoid sanctions. Pananglitan, the group’s arsenal includes such ransomware as WastedLocker, Hades and Phoenix, and PayloadBIN. Evil Corp is also believed to be behind the recently rebranded ransomware DoppelPaymer that was named Grief (or Pay or Grief).

Recent attacks on Olympus ug Sinclair Broadcast Group have been linked to the same Macaw Locker ransomware, which appears to be the new brainchild of Evil Corp., Nagdugo nga Kompyuter now reports.

Analysis of the Macaw code clearly indicates that the malware is another ‘rebrandingof the Evil Corp. malware family. Apparently, while Olympus and Sinclair are the only victims of the new malware.Emsisoft CTO Fabian Vosar told reporters.

Other unnamed sources in the cybersecurity industry shared with the publication the personal pages of the victims of Macaw, where attackers are demanding ransoms in the amount of 450 bitcoins ($28 million) for one attack and $40 million for another. It is not yet clear which buyout applies to which company.

new Macaw malware
Ransom note with link to victim’s personal page

The group’s darknet site contains only a brief description of what happened to the victim, a tool to decrypt three files for free, and a link to a chat room to talk to the attackers.

new Macaw malware

Tugoti ko nga pahinumdoman ka nga kami usab ang nagsulat niana Grief ransomware threatens to destroy victims’ data if they turn to negotiators.

Helga Smith

Kanunay kong interesado sa siyensya sa kompyuter, ilabi na ang seguridad sa datos ug ang tema, nga gitawag karon "siyensya sa datos", sukad pa sa akong pagkabatan-on. Sa wala pa mosulod sa Virus Removal team isip Editor-in-chief, Nagtrabaho ko isip eksperto sa cybersecurity sa daghang kompanya, lakip ang usa sa mga kontraktor sa Amazon. Laing kasinatian: Naa koy pagtudlo sa mga unibersidad sa Arden ug Reading.

Pagbilin ug Tubag

Kini nga site naggamit sa Akismet aron makunhuran ang spam. Hibal-i kung giunsa ang pagproseso sa data sa imong komento.

Balik sa ibabaw nga buton