Slashdot Mirror
Ransomware Hits Three Indian Banks, Causes Millions In Damages (malwarebytes.org)
An anonymous reader writes: Ransomware has locked computers in three major Indian banks and one pharmaceutical company. While the ransom note asks for 1 Bitcoin, so many computers have been infected that damages racked up millions of dollars. According to an antivirus company that analyzed the ransomware, it's not even that complex, and seems the work of some amateur Russians.
And now those jackasses will have to call tech support in India and the shit will REALLY hit the fan.
Most of these ransomware packages can traverse laterally within an org; they run in the rights context of the user on the first infected computer and use that to infect other systems, spreading within the local network. So if you don't have your permissions properly set up (having "Domain Users" in the local Administrators group on your desktops as a matter of standard, for example), it's a cakewalk for the malware to hit everyone.
For your security, this post has been encrypted with ROT-13, twice.
"Amateur Russians."
If they are actually making money from this, then they are firmly in the "professional" bracket.
...
there is a way they can be hunted down and killed. take pictures of the corpses and post them, send the message.
Or Native American?
According to the linked article from Malwarebytes:
It is different than most of the ransomware present nowadays. Instead of spreading to users and automatically infecting their machines, LeChiffre needs to be run manually on the compromised system. Common scenario of infection is that attackers are automatically scanning network in search of poorly secured Remote Desktops, cracking them, and after logging remotely they manually run an instance of LeChiffre.
Just how good is their security if something that has to be manually run on each system has completely pwned them?
Specialist Mac support for creative pros, Melbourne
It was probably them who installed it.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
"Millions of dollars in damages" OR "Millions of Rupee in damages"? - equalling about US$9
Fake news just based on word of mouth. Take a look at the original article referenced in the referenced article and you'll know that not a single aspect of the news is verifiable. No company has been named. No people have been named. Just one person's statement has been bloated into a short article.
I would mother fucking kill those Russians.
Do you even know what "Engrish" actually refers to? Derp.
Il n'y a pas de Planet B.
DESIGNATED
E
S
I
G
N
A
T
E
D
> "Amateur Russians."
> If they are actually making money from this, then they are firmly in the "professional" bracket.
If those hackers were professionals, they wouldn't have attacked India in the first place.
(That country is just too important for Putin to upset. India develops all electronics and software for the Sukhoi T-50 stealth jetfighter, which is slated to enter Russian airforce service in single-seater and India airforce service in two-seater configuration, circa 2020. Russia is also selling lots of military cargo planes, helicopters, tanks and naval hardware to India and they are jointly developing a hyperfast ramjet anti-shipping missile called Brahmos, which is the key to defeating american CVN battle fleets.
Recently India has been quite vocal about the sloppiness and lack of quality control of products russian factories emit and Moscow has been busy appeasing them. The ransomware thus couldn't have come at a worse time.)
Anyhow in Russia, professional means obeys Putin 100% and amateur means... well it means the FSB/GRU will hunt them down to get the keys from India and then they will disappear in some siberian "penal reform-work camp" for 15 years or so.
"ET couldn't confirm the names of the banks and the pharmaceutical company or the total number of computers that were compromised." So it is possible that the whole story is made up.
"In May last year, two Indian conglomerates had to pay about $5 million each after hackers breached their systems. The hackers, suspected to be operating from the Middle East, threatened to leak information to the Indian government if the ransom wasn't delivered. Both are said to have paid up."
So in May the hackers were in Middle East and now they are in Russia? Looks like these hackers are going around the world and paying for their trip by hacking systems.
api.sypexgeo.net
sypexgeo.net
sip1.esampark.com
esampark.com
(The last one's issued as IP address so put it into your firewall as well as 184.107.251.146 blocked...)
APK
P.S.=> However - I wrote something in Delphi 7 32-bit ported into Delphi XE2 & then Delphi XE4 (which allowed inline asm again in the latter for more loop speed, like D7 down to D1 did for 1/32 bit) that stops this thing & OTHERS LIKE IT cold:
APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.start64.com/index.p...
Which populates a custom hosts file with data vs. online threats of ALL kinds (doing a far better job using LESS to do that MORE by far) online, ads, spam/phish payload sources, trackers, etc. - et al from 10 reputable sources in the security community that produce such data (thank goodness for them - I can usually draw between 50-250 of my own on my own each day for this, they provides many, Many, MANY more ontop of my own data gathers for it which makes the hosts file as STRONG as it can be)...
It also increases your:
Speed (adblocking & hardcoded favorites @ the TOP of hosts for the utmost in speed for resolving host-domain names to IP addresses cached in RAM as 1st resolver) in those 2 ways noted!
Which in turn also increases your reliability online (since DNS gets redirect poisoned & 99.999% of ISP DNS are NOT patched vs. the kaminsky flaw that does it) vs. bushwhacked or downed (dns does this a lot) remote dns servers, which are slower in resolution (OpenDNS filters too vs. threats so it's a good combination & hosts lighten DNS server loads too which admins of them ought to like to lessen the chance of being downed due to overloads)
& of course, security per the data I listed above from the source articles too!
(Lastly, it increases anonymity via DNS avoidance for more speed & reliability by avoiding DNS request log tracking too)... apk
"It is distributed as a typical Windows executable: When we run it what appears is a GUI with labels in Russian:" ref
I submitted this story with softpedia, malwarebytes, and india times links,.... why did you remove the india times links? Does it have to be from a silicon valley press company? asshole moderators....
Welcome to Smelt tech support, how may I help you?
...the machines were all disposable. Nothing of worth was actually stored on the computer. For branch employees, who are quite honestly some of the stupidest people on Earth when it comes to computers, they used roaming profiles as well. This allowed them to work at any branch on any computer. All services and data were server-side including copious amounts of Citrix usage. Downtime was never more than 24 hours for any single machine and support staff for each major region kept an average of 50 desktops and 50 laptops on hand pre-imaged and ready to deploy. If the bank mentioned in the article incurred millions in damages it was only due to incompetence, that kind of shit would result in heavy SEC fines in the USA. Lesson to be learned here: never trust IT from India.
An Asian butchering of English. India is in Asia.
tELL mE mORE aBOUT tHESE sEXY aMATEUR rUSSIANS
DESIGNATED