WyzGuys Tech Talk

A quick Saturday digest of cybersecurity news articles from other sources.

From Bruce Schneier

Ransomware Gang Files SEC Complaint

(Bob says: Here is a hilarious twist on ransomware – your attacker drops a dime on you.)

[2023.11.17] A ransomware gang, annoyed at not being paid, filed an SEC complaint against its victim for not disclosing its security breach within the required four days.

This is over the top, but is just another example of the extreme pressure ransomware gangs put on companies after seizing their data. Gangs are now going through the data, looking for particularly important or embarrassing pieces of data to threaten executives with exposing. I have heard stories of executives’ families being threatened, of consensual porn being identified (people regularly mix work and personal email) and exposed, and of victims’ customers and partners being directly contacted. Ransoms are in the millions, and gangs do their best to ensure that the pressure to pay is intense.

LitterDrifter USB Worm

[2023.11.24] A new worm that spreads via USB sticks is infecting computers in Ukraine and beyond.

The group — known by many names, including Gamaredon, Primitive Bear, ACTINIUM, Armageddon, and Shuckworm — has been active since at least 2014 and has been attributed to Russia’s Federal Security Service by the Security Service of Ukraine. Most Kremlin-backed groups take pains to fly under the radar; Gamaredon doesn’t care to. Its espionage-motivated campaigns targeting large numbers of Ukrainian organizations are easy to detect and tie back to the Russian government. The campaigns typically revolve around malware that aims to obtain as much information from targets as possible.

One of those tools is a computer worm designed to spread from computer to computer through USB drives. Tracked by researchers from Check Point Research as LitterDrifter, the malware is written in the Visual Basic Scripting language. LitterDrifter serves two purposes: to promiscuously spread from USB drive to USB drive and to permanently infect the devices that connect to such drives with malware that permanently communicates with Gamaredon-operated command-and-control servers.

BlackCat/ALPHV Ransomware Site Seized in International Takedown Effort

On Dec. 19, the Department of Justice announced the FBI had been working on a disruption campaign against the ransomware group known as ALPHV, Noberus or BlackCat that resulted in the seizure of several of the group’s websites, visibility into their network and a decryption tool that could restore stolen data. International law enforcement agencies from Australia, Denmark, Germany, Spain and the U.K. participated.

The ransomware group, which has distributed ransomware to more than 1,000 victims, reportedly recovered control of its website on Tuesday. Learn how to defend against ransomware.