ரஸ்டில் எழுதப்பட்ட ALPHV ransomware ஐ ஆராய்ச்சியாளர்கள் கண்டுபிடித்துள்ளனர்

Analysts from Recorded Future மற்றும் MalwareHunterTeam have discovered an ALPHV (aka BlackCat) ransomware with executable file is written in Rust, which is atypical for malware, but this approach is gradually gaining popularity among cybercriminals due to its high performance and memory security.

The malware developers themselves call it ALPHV and actively promote their malware on Russian-language hack forums. எனினும், due to the fact that the cybercriminalswebsite uses an icon depicting a black cat, the researchers dubbed the malware BlackCat.

Technically, this ransomware is already the third ransomware written in Rust: PoC malware of this kind was published on GitHub in 2020, and the already inoperative BadBeeTeam ransomware was spotted in the same year.

எனினும், the researchers write that against their background, ALPHV (BlackCat) looks like the first professional RaaS malware aimed at corporate hacking and device encryption. உதாரணத்திற்கு, recently a well-known cybersecurity specialist and Emsisoft analyst Michael Gillespie, described BlackCat as avery complexransomware.

Analyzed another sample of this not too long ago, but couldn’t talk about it due to client confidentialityuses AES128-CTR and RSA-2048, is secure. Filemarker 19 47 B7 4D at EOF and before the encrypted key, which is JSON with some settings. Very sophisticated ransomware.Michael Gillespie wrote.

According to Recorded Future experts, the creator of ALPHV (BlackCat) was previously a member of the well-known hacker group REvil. Since early December, this man (known as ALPHV) has been promoting RaaS on underground forums (XSS and Exploit), inviting other criminals to join ransomware attacks against large companies. The attacker claims that the malware can encrypt data on systems running Windows, Linux and VMware ESXi, and partners will receive from 80% to 90% of the final ransom, depending on the total amount received from the victims.

So far, experts do not know exactly how the malware penetrates the victim’s systems, but like most other ransomware groups, the ALPHV (BlackCat) operators are engaged in double extortion. That is, before encrypting files, hackers search the victim’s network for confidential data, steal it, and then demand a ransom, otherwise they threaten to publish the stolen data in the public domain (or sell it to interested parties).

Currently, the group seems to be managing severalleak sitesat once, each of which stores the data of one or two victims. A screenshot of one of these sites can be seen below. It looks like these sites are being served by the team partners themselves, which explains the different urls.

Screenshot of leak site

Bleeping Computer reports that since November 2021, many companies in the USA, Australia and India have become victims of this ransomware. The journalistsown sources say the ransom size ranges from $ 400,000 to $ 3,000,000 (in Bitcoin or Monero). If victims pay with Bitcoin, an additional 15% commission is added to the ransom.

அறிமுகம்

Let me remind you that we also reported that Grief ransomware threatens to destroy victimsdata if they turn to negotiators.

ஹெல்கா ஸ்மித்

நான் எப்போதும் கணினி அறிவியலில் ஆர்வமாக இருந்தேன், குறிப்பாக தரவு பாதுகாப்பு மற்றும் தீம், இது இன்று அழைக்கப்படுகிறது "தரவு அறிவியல்", என் இளமை பருவத்தில் இருந்து. வைரஸ் அகற்றும் குழுவில் தலைமை ஆசிரியராக வருவதற்கு முன், நான் பல நிறுவனங்களில் சைபர் பாதுகாப்பு நிபுணராக பணிபுரிந்தேன், அமேசான் ஒப்பந்ததாரர்களில் ஒருவர் உட்பட. இன்னொரு அனுபவம்: எனக்கு Arden மற்றும் Reading பல்கலைக்கழகங்களில் கற்பித்தல் உள்ளது.

ஒரு பதிலை விடுங்கள்

ஸ்பேமைக் குறைக்க இந்தத் தளம் Akismet ஐப் பயன்படுத்துகிறது. உங்கள் கருத்துத் தரவு எவ்வாறு செயலாக்கப்படுகிறது என்பதை அறிக.

மேலே பொத்தானுக்குத் திரும்பு