PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Ransomware Zeppelin nhắm vào các công ty công nghệ và chăm sóc sức khoẻ

blog.viettelcybersecurity.com | incident | #ransomware | #healthcare | #zeppelin | #vega | #blackberry-cylance | #delphi
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Zeppelin, a new Delphi-based Vega ransomware variant, targets IT and healthcare firms in Europe, the US and Canada with customizable configs, AES-256 and RSA encryption, and stealth features.
Published
Collected

Related coverage

incident · blog.viettelcybersecurity.com
APT kết hợp với Ransomware: Phân tích thực trạng
A Viettel Cyber Security analysis of the current trend of APT groups combining their operations with ransomware attacks.
incident · blog.viettelcybersecurity.com
Nghiên cứu chuyên sâu về Tình hình mã độc mã hóa tống tiền tại Việt Nam
An in-depth Viettel Cyber Security study examining the ransomware threat landscape and attack trends across Vietnam.
incident · blog.viettelcybersecurity.com
Tấn công Ransomware “quật ngã” hệ thống ống dẫn nhiên liệu chủ chốt của Hoa Kỳ
A ransomware attack attributed to an Eastern European group forced Colonial Pipeline, supplier of nearly half the US East Coast's fuel, to shut down its entire system and triggered a federal response.
incident · blog.viettelcybersecurity.com
Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus
The Snatch ransomware reboots infected Windows machines into Safe Mode, where most third-party antivirus cannot run, then encrypts files and wipes shadow copies; it also exfiltrates data.
incident · blog.viettelcybersecurity.com
Snatch Ransomware khởi động lại Windows ở chế độ Safe Mode để vượt qua Anti-Virus
A new Snatch ransomware variant reboots infected Windows hosts into Safe Mode to evade antivirus, persists as the SuperBackupMan service, wipes Volume Shadow Copies and also steals data.
incident · wiz.io
Defending against database ransomware attacks
Wiz examines 'malware-less' database ransomware: exposed MySQL, PostgreSQL and MongoDB servers with weak auth are looted, wiped and ransomed via native commands — no malware to detect.
Back