Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
SEVERITY: High
CATEGORY: Emerging Threat
ANALYSIS SUMMARY
Attackers using targeted ransomware work on the following methodology:
Successful acquiring of administrator privilege ensures enough damage by the ransomware that the victims have to pay 5-6 figure ransom for decryption of their files. Primarily, industries related to commodities, healthcare and manufacturing are being targeted. Ryuk shows close ties with the HERMES ransomware, a production of the North Korean Lazarus group.
Following is the ransom note found on encrypted computers.
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN – files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at ????????@protonmail.com
or ????????@tutanota.com
BTC wallet: ???????????????????????????????? Ryuk
Ryuk demands ransoms of between 15 and 50 bitcoins (between $50,000 and $170,000), with the price escalating by 0.5 bitcoins every day the victim doesn’t pay.
IMPACT
System Access, Files encryption, Ransom payment
INDICATORS OF COMPROMISE
IP(s) / Hostname(s)
URLs
Associated-file-path:
Associated-email-addresses:
Associated-bitcoin-address: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Malware Hash (MD5/SHA1/SH256)
REMEDIATION
Block all the threat indicators at their respective controls.