MSP Threats Security Team

MSP Threats Security Team

Latest stories from MSP Threats Security Team

28 April 2020 — 4 min read

Acronis

28 April 2020 — 4 min read

Cyberattacks Target Remote Work Tools

Remote access to business environments has become a vital part of everyday work during the COVID-19 pandemic. One of the common ways an employee like a tech support staffer can connect to a remote employee’s work computer is the Remote Desktop service, which has some well-known security vulnerabilities.

24 April 2020 — 3 min read

Acronis

24 April 2020 — 3 min read

COVID-19 Themed Cyberattacks Taking Hold

Cybercriminals continue to exploit the COVID-19 theme in their cyberattacks, trying to trick user into entering their credentials or personal information on a phishing web page or loading malicious documents that pretend to contain essential information related to the COVID-19 pandemic. Here is a quick roundup of examples that show how scammers and hackers are leveraging the crisis.

18 October 2019 — 9 min read

Acronis

18 October 2019 — 9 min read

HILDACRYPT: A Ransomware Newcomer Hits Backup and Anti-virus Solutions

A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware. HILDACRYPT camouflages itself as a legitimate XAMPP installer, which is an easy to install Apache distribution containing MariaDB, PHP, and Perl. However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature. We took a deep dive into this new cyberthreat to show how it works and how you can help overcome its attack with Acronis Cyber Backup.

07 October 2019 — 17 min read

Acronis

07 October 2019 — 17 min read

Threat Analysis: Nemty Ransomware and the Fake PayPal Site

We took a deep dive into the Nemty ransomware strain, a sophisticated new form of malware that's spreading via a fake PayPal website. Similar in some aspects to Buran and GandCrab ransomware strains, Nemty incorporates three distinct layers of encryption to lock down victim data. Learn how this threat to your system works and how Acronis can help you evade and overcome it.

24 September 2019 — 6 min read

Acronis

24 September 2019 — 6 min read

Syrk Ransomware Delivers Encryption Payload via PowerShell Script

We took a deep dive into the insidious Syrk ransomware strain that targets young Fortnite players to deliver a debilitating encryption payload complete with Cryptolocker anti-monitoring and self-defense capabilities. Learn how this threat to your system works and how Acronis can help you overcome it to keep your files safe.

16 August 2019 — 14 min read

Acronis

16 August 2019 — 14 min read

Meet Buran: The New Delphi Ransomware Delivered via RIG Exploit Kit

Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered in June 2019. What’s interesting is that this cryptolockers’ code was written in Object Pascal in Delphi IDE – a programming language that was popular in Latin American and former Soviet Union countries around two decades ago when it was being taught in colleges and technical universities. Let’s take a close look at this ransomware to find out the installation process, communication details, and encryption model.

03 February 2018 — 9 min read

Acronis

03 February 2018 — 9 min read

SpriteCoin is a New Ransomware, Not Cryptocurrency

The new SpriteCoin ransomware (also known as MoneroPay) leverages a novel social engineering technique – posing as a new cryptocurrency called SpriteCoin. It packs a one-two punch as well, combining a cryptolocker and password stealer in a single application. The link to the SpriteCoin homepage was published on the bitcointalk.org forum and spread among users interested in new cryptocurrencies. The topic was removed when its malicious nature was revealed, but let’s take a look at the details.

29 January 2018 — 8 min read

Acronis

29 January 2018 — 8 min read

Rapid Ransomware Keeps Encrypting New Files in Background

The Rapid ransomware variant began attacking victims at the end of December 2017, according to the ID ransomware service Malwarehunterteam. This ransomware strain is interesting and unique because it keeps running even after encryption is completed, and continues encrypting files once they are created. Our team analyzed a new sample that was compiled a week ago.

22 January 2018 — 6 min read

Acronis

22 January 2018 — 6 min read

Paradise Ransomware strikes again

The Paradise ransomware that was seen in September 2017 is back, launching a new round of attacks in early January. This strain provides an unbreakable encryption scheme by using the RSA cipher for file encryption – an unusual cipher choice that makes fighting this strain even more challenging. Here’s a complete analysis of Paradise ransomware so you know what you’re facing, and how you can avoid it.

15 January 2018 — 13 min read

Acronis

15 January 2018 — 13 min read

GlobeImposter ransomware: A holiday gift from the Necurs botnet

On December 26, 2017, the Necurs botnet delivered a late Christmas gift – the new version of GlobeImposter ransomware. Attached to spam messages as zip archives, the zip archive contains a JavaScript that downloads and installs ransomware on a victim’s computer.

14 November 2017 — 10 min read

Acronis

14 November 2017 — 10 min read

Locky Empire Strikes Back

Locky is one of the most widespread and active ransomware families on the malicious threats landscape. There is a new version that just appeared a couple of days ago. It’s being delivered by the Necurs botnet through SPAM emails containing Microsoft Word macros exploiting the Microsoft’s Dynamic Data Exchange (DDE). DDE is a Windows feature that handles the electronic transfer of MS Office files using shared memory and data.

09 August 2017 — 12 min read

Acronis

09 August 2017 — 12 min read

A Serpent That Pretends to Be an Octopus: A New Step in Zyklon Ransomware Evolution

Serpent is the 4th generation of the malware originally known as Zyklon. First, it became WildFire, then Hades Locker, and now, Serpent. This type of ransomware typically spreads through spear phishing emails containing a link to download the cryptolocker.