Attacks/Breaches

12/20/2017
11:50 AM
50%
50%

Five Arrested for Cerber, CTB-Locker Ransomware Spread

Authorities arrest three Romanian suspects for spreading CTB-Locker malware and two for a ransomware case linked to the United States.

Romanian authorities have arrested three suspects for spreading a form of ransomware called Curve-Tor-Bitcoin Locker (CTB-Locker) throughout Europe. Two members of the same criminal group have been arrested for distributing Cerber ransomware within the United States.

An investigation into CTB-Locker began in early 2017, when authorities were alerted to Romanian nationals sending spam messages designed to look like they came from Italy, the Netherlands, and the UK. The messages infected systems and encrypted data with CTB-Locker ransomware, which targets almost all versions of Windows including XP, Vista, 7, and 8.

Two suspects were arrested for contaminating a large number of systems in the US with Cerber ransomware. Initially the two investigations were separate, but they were combined when it was discovered people in the same Romanian criminal group was responsible for both. Suspects did not develop the malware themselves but acquired it before launching infection campaigns.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:41:23 PM
Re: Never pay the ransom
But many small businesses and some large ones (Merck) don't have a tested plan in place - ergo? I am not suprise about this, I have involved a few other big companies and they are not there yet either.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:39:34 PM
Re: Never pay the ransom
Also, never open an attachment received from someone you don't know This is a good suggestion, that may be better options than anything else we can do.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:37:41 PM
Re: Never pay the ransom
This includes regularly backing up the data stored on your computer, Sometime backup is encrypted too, so it needs to be an off-site backup in my view.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:36:14 PM
Re: Never pay the ransom
Never pay the ransom I would agree however if you do not have a backup and data is lost, you do not have so much options.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:34:29 PM
Arrest
I say arrest is a good news it represents there are consequences for their actions and they can not get away with it.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
12/22/2017 | 2:01:37 PM
Re: Never pay the ransom
Ransomeware is a 900 pound paper tiger.  IF you do not have a good backup and restoration plan, you are screwed.  IF you have a tested plan in place --- hey, the only real issue is data exfiltration.  But many small businesses and some large ones (Merck) don't have a tested plan in place - ergo? 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/22/2017 | 10:09:32 AM
Never pay the ransom
This is an item that I have advocated for quite some time. Ransomware though easy to execute is also easy to mitigate. This comes directly from the linked article:

"This includes regularly backing up the data stored on your computer, keeping your systems up to date and installing robust antivirus software. Also, never open an attachment received from someone you don't know or any odd looking link or email sent by a friend on social media, a company, online gaming partner, etc."
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.