Research reports
1,224 reports from 387 publishers45 added in the past week
8 reports, newest added first
Added Thu 7 May
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up… Sort Of
You’ve probably heard of the Conti ransomware group. After their 2020 emergence, they’ve accumulated at least 700 victims, where by “victims” we mean ‘big fish’ corporations with millions of dollars in revenue; unlike your average neighborhood ransomware…
Ransomware
“Troldesh” – New Ransomware from Russia
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world. Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files.…
RansomwareMalware
Pulling the Curtains on Azov Ransomware: Not a Skidsware but Polymorphic Wiper
Check Point Research (CPR) provides under-the-hood details of its analysis of the infamous Azov Ransomware Investigation shows that Azov is capable of modifying certain 64-bit executables to execute its own code Azov is designed to inflict impeccable damage…
RansomwareMalware
Added Fri 24 Apr
Charger Malware Calls and Raises the Risk on Google Play
Several weeks ago, Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “Charger.” This incident demonstrates how…
RansomwareMalwareMobile
Added Sun 19 Apr
CRYING IS FUTILE: SandBlast Forensic Analysis of WannaCry
Using the NSA exploit EternalBlue released by the Shadow Brokers, the WannaCry ransomware developers have added their names to malware lore. Given the number of institutions hit and the amount of media generated, it seemed appropriate to show what the…
Ransomware
Added Thu 16 Apr
Agrius Deploys Moneybird in Targeted Attacks Against Israeli Organizations
Iranian threat actor Agrius continues to operate against Israeli targets, masking destructive influence operations as ransomware attacks. In recent attacks the group deployed Moneybird, a previously unseen ransomware written in C++. Despite presenting…
Ransomware
Added Sun 12 Apr
Trickbot Rebirths Emotet: 140,000 Victims in 149 Countries in 10 Months
Check Point Research (CPR) warns of potential ransomware attacks, as it sees samples of Emotet fast-spreading via Trickbot. Since Emotet’s takedown by law enforcement, CPR estimates 140,000 victims of Trickbot, across 149 countries in only 10 months. New…
RansomwareMalwareTakedowns and arrests
Added Thu 9 Apr
Ryuk Ransomware: A Targeted Campaign Break-Down
Over the past two weeks, Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. So far the campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.…
Ransomware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.