Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
High
Analysis Summary
A new ransomware campaign dubbed MegaCortex has been observed targeting business networks corporate networks worldwide. Once a network is penetrated, the attackers infect the entire network by distributing the ransomware using Windows domain controllers. Since it is fairly a new ransomware, currently not much is known about their encryption algorithms, exactly how attackers gain access to the network and how the ransom payments are being acknowledged by the attackers.
Initial infection is speculated to start from the Emotet exploit kit. MegaCortex uses both a manual and automated process starting with Meterpreter reverse shell scripts. From there, PowerShell scripts, batch files and remotely executed commands are utilized to execute the final stage malware on specific machines. Once activated, the malware encrypts files on the machine with an undetermined encryption algorithm.
The ransomware note looks like this:
Impact
Loss of sensitive information
Indicators of Compromise
IP(s) / Hostname(s)
89[.]105[.]198[.]28
Email Address
Malware Hash (MD5/SHA1/SH256)
478dc5a5f934c62a9246f7d1fc275868f568bc07
Remediation