• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – New Exploits for Unsecure SAP Systems
May 6, 2019
Rewterz Threat Advisory – CVE-2019-1867 Cisco Elastic Services Controller REST API Authentication Bypass Vulnerability
May 8, 2019

Rewterz Threat Alert – MegaCortex Ransomware Targeting Business Networks

May 7, 2019

Severity

High

Analysis Summary


A new ransomware campaign dubbed MegaCortex has been observed targeting business networks corporate networks worldwide. Once a network is penetrated, the attackers infect the entire network by distributing the ransomware using Windows domain controllers. Since it is fairly a new ransomware, currently not much is known about their encryption algorithms, exactly how attackers gain access to the network and how the ransom payments are being acknowledged by the attackers.

Initial infection is speculated to start from the Emotet exploit kit. MegaCortex uses both a manual and automated process starting with Meterpreter reverse shell scripts. From there, PowerShell scripts, batch files and remotely executed commands are utilized to execute the final stage malware on specific machines. Once activated, the malware encrypts files on the machine with an undetermined encryption algorithm.

The ransomware note looks like this:

MegaCortex Ransom Note

Impact

Loss of sensitive information

Indicators of Compromise

IP(s) / Hostname(s)

89[.]105[.]198[.]28

Email Address

  • shawhart1542925@mail.com
  • anderssperry6654818@mail.com

Malware Hash (MD5/SHA1/SH256)

478dc5a5f934c62a9246f7d1fc275868f568bc07 

Remediation

  • Block threat indicators at your respective controls.
  • Always have reliable backup of your files.
  • MegaCortex ransomware is not being spread via spam, it can be installed via trojans so users must ensure to identify spam and not to open any attachments without confirming.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.