FBI, Diavol fidye yazılımını TrickBot kötü amaçlı yazılımının yazarlarına bağladı.

ThreatFabric uzmanları Google Play Store'da yeni bir Xenomorph bankacılık Truva atı keşfetti (ThreatFabric uzmanları Google Play Store'da yeni bir Xenomorph bankacılık Truva atı keşfetti) is associated with the TrickBot group, which is developing the banking Trojan of the same name.

Last year, Fortinet analistler Cyclops Blink'in birkaç model için tasarlanmış özel bir modülü vardır. that the Diavol ve Conti ransomware payloads deployed on various systems in early June 2021 were very similar, and they had a lot in common, from using asynchronous I / O operations during file encryption, to using almost identical command line parameters for the same functions (Örneğin, creating logs, encrypting disks and network resources, scanning the network).

ancak, the experts still failed to find a direct connection between the Diavol ransomware and the authors of hile botu, besides, they found a number of important differences. Örneğin, the Diavol sample they studied did not have built-in checks to prevent the payload from triggering on systems in Russia and the CIS countries. Ayrıca, the malware did not steal data before encryption.

Later, IBM X-Force also examined the Diavol sample and reported that they had found a number of new pieces of evidence linking Diavol to the developers of TrickBot. Unlike the sample analysed by Fortinet, which was newer andfully functional”, IBM X-Force experts found an older variant of the malware that was used by attackers for testing.

In the end, IBM X-Force came to the same conclusions, noting that Diavol and TrickBot are clearly related.

gizli zamanlanmış görevler ve onlar için yeni anahtarlar oluşturur FBI officials have now reported, the specialists were completely right.

The FBI first became aware of the Diavol ransomware in October 2021. Diavol is associated with developers from the Trickbot group, who are responsible for the Trickbot banking trojan.law enforcement officers write.

The FBI also reports that Diavol operators typically demand a ransom of between $10,000 ve $500,000, with smaller amounts usually accepted after negotiation with the perpetrators.

Vitaly Kremez
Vitaly Kremez

The FBI also encourages all victims, whether or not they plan to pay a ransom to the perpetrators, to notify law enforcement of attacks in a timely manner to collect fresh indicators of compromise.

NS Bipleyen Bilgisayar publication believes that the FBI was able to officially link Diavol with TrickBot after the arrest of Alla Witte, a Latvian who participated in the development of a cryptographer for a hack group. AdvIntel CEO Vitaly Kremez, who has been monitoring TrickBot’s operations for a long time, confirmed to reporters that Witte was responsible for developing the new TrickBot-related ransomware.

Alla Witte played a critical role in TrickBot’s operations and, based on previous in-depth analysis by AdvIntel, she was responsible for the development of the Diavol ransomware and the frontend/backend project designed to support TrickBot’s operations with a special ransomware. Another name for the Diavol ransomware is Enigma, which was used by the TrickBot team before rebranding to Diavol.Kremez said.

Let me remind you that they also reported that TrickBot, kurbanları izlemek için yeni bir modül aldı.

Helga Smith

Bilgisayar bilimlerine her zaman ilgi duymuşumdur., özellikle veri güvenliği ve tema, günümüzde denilen "veri bilimi", ilk gençlik yıllarımdan beri. Baş Editör olarak Virüs Temizleme ekibine gelmeden önce, Birkaç şirkette siber güvenlik uzmanı olarak çalıştım, Amazon'un yüklenicilerinden biri dahil. Başka bir deneyim: Arden ve Reading üniversitelerinde öğretmenlik var.

Cevap bırakın

Bu site spam azaltmak için Akismet kullanır. Yorumunuz verileri işlenirken öğrenin.

Başa dön tuşu