Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
A new ransomware called TFlower Ransomware is being used to target corporate environments. The ransomware is installed on networks after attackers hack into exposed Remote Desktop services. Once the attackers gain access to the machine, they will infect it and may attempt to traverse the network through tools such as PowerShell Empire, PSExec, etc. When executed, the ransomware will display a console that shows the activity being performed by the ransomware.
Once the encryption begins, connection to C2 server is made, which is located on a hacked WordPress site with the following URL.
https[:]//www[.]domain[.]com/wp-includes/wp-merge[.]php?name=[computer_name]&state=start
It will then proceed to encrypt the data on the computer, skipping any files in the Windows or Sample Music folders. When encrypting files, it will not add an extension, but will prepend the *tflower marker and what appears to be the encrypted encryption key for the file.
Ransom note file named “!_Notice_!.txt” is found throughout the computer and on the Windows Desktop, which looks like this:
URLs
Filename
chilli.exe
Email Address
Malware Hash (MD5/SHA1/SH256)