Slashdot Mirror
Ransomware Hits Three Indian Banks, Causes Millions In Damages (malwarebytes.org)
An anonymous reader writes: Ransomware has locked computers in three major Indian banks and one pharmaceutical company. While the ransom note asks for 1 Bitcoin, so many computers have been infected that damages racked up millions of dollars. According to an antivirus company that analyzed the ransomware, it's not even that complex, and seems the work of some amateur Russians.
And now those jackasses will have to call tech support in India and the shit will REALLY hit the fan.
Most of these ransomware packages can traverse laterally within an org; they run in the rights context of the user on the first infected computer and use that to infect other systems, spreading within the local network. So if you don't have your permissions properly set up (having "Domain Users" in the local Administrators group on your desktops as a matter of standard, for example), it's a cakewalk for the malware to hit everyone.
For your security, this post has been encrypted with ROT-13, twice.
"Amateur Russians."
If they are actually making money from this, then they are firmly in the "professional" bracket.
...
there is a way they can be hunted down and killed. take pictures of the corpses and post them, send the message.
According to the linked article from Malwarebytes:
It is different than most of the ransomware present nowadays. Instead of spreading to users and automatically infecting their machines, LeChiffre needs to be run manually on the compromised system. Common scenario of infection is that attackers are automatically scanning network in search of poorly secured Remote Desktops, cracking them, and after logging remotely they manually run an instance of LeChiffre.
Just how good is their security if something that has to be manually run on each system has completely pwned them?
Specialist Mac support for creative pros, Melbourne
It was probably them who installed it.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Fake news just based on word of mouth. Take a look at the original article referenced in the referenced article and you'll know that not a single aspect of the news is verifiable. No company has been named. No people have been named. Just one person's statement has been bloated into a short article.
Do you even know what "Engrish" actually refers to? Derp.
Il n'y a pas de Planet B.
"ET couldn't confirm the names of the banks and the pharmaceutical company or the total number of computers that were compromised." So it is possible that the whole story is made up.
"In May last year, two Indian conglomerates had to pay about $5 million each after hackers breached their systems. The hackers, suspected to be operating from the Middle East, threatened to leak information to the Indian government if the ransom wasn't delivered. Both are said to have paid up."
So in May the hackers were in Middle East and now they are in Russia? Looks like these hackers are going around the world and paying for their trip by hacking systems.
"It is distributed as a typical Windows executable: When we run it what appears is a GUI with labels in Russian:" ref