The Week in Ransomware - May 7th 2021 - Attacking healthcare

While ransomware attacks continued throughout the week, for the most part, it has been quieter than usual, with only a few new variants released.

The biggest news was the attack on health care giant Scripps Health whose operations were severely impacted by a ransomware attack. 

We also saw a new ransomware called N3TW0RM targeting Israeli companies using an interesting client-server encryption method.

Finally, we learned that Cuba Ransomware is now partnered with Hancitor to compromise and encrypt corporate networks more quickly.

Contributors and those who provided new ransomware information and stories this week include: @jorntvdw, @Ionut_Ilascu, @malwareforme, @LawrenceAbrams, @PolarToffee, @serghei, @demonslay335, @DanielGallagher, @malwrhunterteam, @FourOctets, @struppigel, @VK_Intel, @fwosar, @BleepinComputer, @Seifreed, @Intel_by_KELA, @AndreGironda, @GroupIB_GIB, @SophosLabs, @AltShiftPrtScn, @M0teki, @fbgwls245, @pcrisk, @chum1ng0, @PogoWasRight, @3xp0rtblog, @ProferoSec, @SecurityJoes, @cPeterr, and @y_advintel.

May 3rd 2021

Health care giant Scripps Health hit by ransomware attack

Nonprofit health care provider Scripps Health in San Diego is currently dealing with a ransomware attack that forced the organization to suspend user access to its online portal and switch to alternative methods for patient care operations.

N3TW0RM ransomware emerges in wave of cyberattacks in Israel

A new ransomware gang known as 'N3TW0RM' is targeting Israeli companies in a wave of cyberattacks starting last week.

New Nitro Ransomware variant

MalwareHunterTeam found a new Nitro Ransomware variant calling itself  'ArchAngel Ransomware.'

New Galaxy Ransomware

Yelisey Boguslavskiy discovered that a new Galaxy Ransomware operation was getting ready to launch and would be stealing data from victims.

New Henry Ransomware

dnwls0719 found the new Henry Ransomware that appends the .henry217 extension.

May 4th 2021

New WastedLocker variant

dnwls0719 found a WastedLocker variant that appends the .saverswasted extension.

New Toxin Ransomware sold on hacker forums

3xp0rt noticed that a new Toxin Ransomware was being promoted on hacking forums.May 5th 2021

New STOP Ransomware variant

Michael Gillespie has found a new STOP Ransomware variant that appends the .rejg extension.

Cuba Ransomware Group on a Roll

At the end of 2020, our team, made up of SecurityJoes and Profero incident responders, led an investigation into a complex attack in which hundreds of machines were encrypted, knocking the victim company offline completely. The threat actors behind the attack deployed the Cuba ransomware across the corporate network, using a mixture of PowerShell scripts, SystemBC, and Cobalt Strike to propagate it. Cuba Ransomware utilizes the symmetric ChaCha20 algorithm for encrypting files, and the asymmetric RSA algorithm for encrypting key information

They Told Their Therapists Everything. Hackers Leaked It All

“If we receive €200 worth of Bitcoin within 24 hours, your information will be permanently deleted from our servers,” the email said in Finnish. If Jere missed the first deadline, he’d have another 48 hours to fork over €500, or about $600. After that, “your information will be published for all to see.”

May 6th 2021

A student pirating software led to a full-blown Ryuk ransomware attack

A student's attempt to pirate an expensive data visualization software led to a full-blown Ryuk ransomware attack at a European biomolecular research institute.

Darkside Ransomware Overview

This is my report for one of the latest Windows samples of Darkside Ransomware v1.8.6.2!

May 7th 2021

Data leak marketplaces aim to take over the extortion economy

Cybercriminals are embracing data-theft extortion by creating dark web marketplaces that exist solely to sell stolen data.

Cuba Ransomware partners with Hancitor for spam-fueled attacks

The Cuba Ransomware gang has teamed up with the spam operators of the Hancitor malware to gain easier access to compromised corporate networks.

New GoNNaCry ransomware

dnwls0719 found a ransomware that appends the .GoNNaCry extension.

Insurer AXA halts ransomware crime reimbursement in France

In an apparent industry first, the global insurance company AXA said Thursday it will stop writing cyber-insurance policies in France that reimburse customers for extortion payments made to ransomware criminals.

That's it for this week! Hope everyone has a nice weekend!