Today, the Russian government announced that they arrested fourteen members of the REvil ransomware gang on behalf of US authorities.
While the ransomware gang members are only being charged with “illegal circulation of means of payment,” the arrests are the first public action by Russia to stem the activities of ransomware gangs operating within the country.
Furthermore, Russia states that they took this action on behalf of US law enforcement, who they have historically been reluctant to help in criminal cybercrime investigations.
However, some threat actors believe that this is just Russia trying to appease the USA and that future law enforcement cooperation will not be common.
Ukrainian police also arrested members of a ransomware operation who encrypted at least fifty firms in the USA and Europe. However, the name of the ransomware gang has not been disclosed.
Other news this week is the finding of a Linux encryptor for the AvosLocker ransomware operation that targets VMware ESXi, the Night Sky ransomware operation using Log4j attacks, TellYouThePass returns as a multi-platform Golang threat, and that Magniber ransomware using signed APPX files to infect victims.
Contributors and those who provided new ransomware information and stories this week include: @fwosar, @BleepinComputer, @DanielGallagher, @PolarToffee, @malwrhunterteam, @demonslay335, @billtoulas, @jorntvdw, @serghei, @VK_Intel, @malwareforme, @struppigel, @LawrenceAbrams, @FourOctets, @Ionut_Ilascu, @Seifreed, @ahnlab, @CrowdStrike, @MsftSecIntel, @ChristiaanBeek, @fbgwls245, @Amigo_A_,@JakubKroustek, and @pcrisk.
January 8th 2022
dnwls0719 found the new Wasp Ransomware that appends the .0.locked extension to encrypted files.
January 10th 2022
AvosLocker is the latest ransomware gang that has added support for encrypting Linux systems to its recent malware variants, specifically targeting VMware ESXi virtual machines.
FinalSite announced today the findings of a six-day investigation into last week’s ransomware attack, stating it found no evidence schools’ data accessed or stolen by hackers.
Jakub Kroustek found a new STOP ransomware variant that appends the .nqhd extension.
January 11th 2022
The Night Sky ransomware gang has started to exploit the critical CVE-2021-44228 vulnerability in the Log4j logging library, also known as Log4Shell, to gain access to VMware Horizon systems.
January 12th 2022
The Magniber ransomware has been spotted using Windows application package files (.APPX) signed with valid certificates to drop malware pretending to be Chrome and Edge web browser updates.
TellYouThePass ransomware has re-emerged as a Golang-compiled malware, making it easier to target more operating systems, macOS and Linux, in particular.
A cyberattack against Albuquerque Public Schools prompted the state’s largest district to cancel all classes districtwide on Thursday and possibly Friday.
PCrisk found a new STOP ransomware variant that appends the .zaqi extension to encrypted files.
January 13th 2022
Ukrainian police officers have arrested a ransomware affiliate group responsible for attacking at least 50 companies in the U.S. and Europe.
January 14th 2022
The Federal Security Service (FSB) of the Russian Federation says that they shut down the REvil ransomware gang after U.S. authorities reported on the leader.