Attacks/Breaches

12/20/2017
11:50 AM
50%
50%

Five Arrested for Cerber, CTB-Locker Ransomware Spread

Authorities arrest three Romanian suspects for spreading CTB-Locker malware and two for a ransomware case linked to the United States.

Romanian authorities have arrested three suspects for spreading a form of ransomware called Curve-Tor-Bitcoin Locker (CTB-Locker) throughout Europe. Two members of the same criminal group have been arrested for distributing Cerber ransomware within the United States.

An investigation into CTB-Locker began in early 2017, when authorities were alerted to Romanian nationals sending spam messages designed to look like they came from Italy, the Netherlands, and the UK. The messages infected systems and encrypted data with CTB-Locker ransomware, which targets almost all versions of Windows including XP, Vista, 7, and 8.

Two suspects were arrested for contaminating a large number of systems in the US with Cerber ransomware. Initially the two investigations were separate, but they were combined when it was discovered people in the same Romanian criminal group was responsible for both. Suspects did not develop the malware themselves but acquired it before launching infection campaigns.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:41:23 PM
Re: Never pay the ransom
But many small businesses and some large ones (Merck) don't have a tested plan in place - ergo? I am not suprise about this, I have involved a few other big companies and they are not there yet either.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:39:34 PM
Re: Never pay the ransom
Also, never open an attachment received from someone you don't know This is a good suggestion, that may be better options than anything else we can do.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:37:41 PM
Re: Never pay the ransom
This includes regularly backing up the data stored on your computer, Sometime backup is encrypted too, so it needs to be an off-site backup in my view.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:36:14 PM
Re: Never pay the ransom
Never pay the ransom I would agree however if you do not have a backup and data is lost, you do not have so much options.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/24/2017 | 4:34:29 PM
Arrest
I say arrest is a good news it represents there are consequences for their actions and they can not get away with it.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
12/22/2017 | 2:01:37 PM
Re: Never pay the ransom
Ransomeware is a 900 pound paper tiger.  IF you do not have a good backup and restoration plan, you are screwed.  IF you have a tested plan in place --- hey, the only real issue is data exfiltration.  But many small businesses and some large ones (Merck) don't have a tested plan in place - ergo? 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/22/2017 | 10:09:32 AM
Never pay the ransom
This is an item that I have advocated for quite some time. Ransomware though easy to execute is also easy to mitigate. This comes directly from the linked article:

"This includes regularly backing up the data stored on your computer, keeping your systems up to date and installing robust antivirus software. Also, never open an attachment received from someone you don't know or any odd looking link or email sent by a friend on social media, a company, online gaming partner, etc."
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Major International Airport System Access Sold for $10 on Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  7/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Cyberspace is much less secure than my old lamp.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6681
PUBLISHED: 2018-07-17
Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.
CVE-2018-13864
PUBLISHED: 2018-07-17
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.
CVE-2018-14338
PUBLISHED: 2018-07-17
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
CVE-2018-14337
PUBLISHED: 2018-07-17
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
CVE-2018-14329
PUBLISHED: 2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.