One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 3791020 |
| Date de publication | 2021-11-30 11:26:16 (vue: 2021-12-13 21:05:26) |
| Titre | New Variant of Phobos Ransomware Hitting the Wild |
| Texte | FortiGuard Labs is aware that a new variant of Phobos ransomware is hitting the wild. Phobos ransomware is thought to have a close relationship to the CrySIS and Dharma ransomware families. Phobos ransomware encrypts files with predetermined file extensions and deletes shadow copies and the backup catalog to prevent the easy restoration of the files.Why is this Significant?This is significant because Phobos is an older ransomware that has been around since at least late 2017 and has been updated several times since. The newly observed variant provides a proof that Phobos is still actively developed and used. What is Phobos Ransomware?Phobos is a ransomware that is thought to be closely related to the CrySIS and Dharma ransomware families and generally targets small to medium-sized businesses. There is not much notable about the ransomware as it encrypts files with predetermined file extensions and deletes shadow copies and the backup catalog to prevent the easy restoration of the files. This particular Phobos ransomware variant adds "[(removed)@imap.cc].XIII.XIII" file extension to the files it encrypts and demands ransom to decrypt the affected files.How does Phobos Ransomware Arrive?Phobos ransomware is delivered either via malicious attachments in emails or through vulnerable Remote Desktop Protocol (RDP) connections.What is the Status of Coverage?FortiGuard Labs provides AV coverage against this new variant of Phobos ransomware as W32/Generic.AP.34AB98!tr.FortiGuard Labs provides the following AV protection against other known variants of Phobos ransomware:W32/Phobos.A!tr.ransomW32/Phobos.B!trW32/Filecoder_Phobos.A!trW32/Filecoder_Phobos.A!tr.ransomW32/Filecoder_Phobos.B!trW32/Phobos.B!tr.ransomW32/Phobos.C!trW32/Phobos.C!tr.ransomW32/Filecoder_Phobos.E!tr.ransomW32/Phobos.E!tr.ransomW32/Phobos.F!tr.ransomW32/Filecoder_Phobos.C!trW32/Phobos.HGAF!tr.ransomW32/Phobos.B828!tr.ransomW32/Phobos.B936!tr.ransomW32/Filecoder_Phobos.E!trW32/Phobos.3257!tr.ransomW32/Phobos.8B03!tr.ransomW32/Filecoder_Phobos.C!tr.ransomW32/PhobosRansom.190E!tr.ransomRiskware/Filecoder_PhobosAny Other Suggested Mitigation?Due to the ease of disruption and the potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network. |
| Envoyé | Oui |
| Condensat | 190e 2017 3257 34ab98 8b03 @imap about access accomplished actively addressed adds affected against all also always are around arrive attachments attackers attacks aware awareness b828 b936 backup because been being businesses can catalog caution close closely conduct connections copies could coverage crucial crysis daily damage date decrypt deletes delivered demands department desktop developed dharma disruption distribution does don due ease easy educate either emails employees encourage encouraged encrypts end engineering ensure establishing etc extension extensions families file files following foothold fortiguard from generally has have help hgaf hitting how identifiable important impromptu inform information initial internal ips keep know known labs late latest least links made malicious mechanisms medium mitigation much need network never new newly not notable observed older ongoing open operations organization organizations other particular personally personnel phishing phishing/spearphishing phobos phobosany pii potential predetermined prevent proof protect protection protocol provides ransom ransomriskware/filecoder ransomw32/filecoder ransomw32/phobos ransomw32/phobosransom ransomware ransomware:w32/phobos rdp regular related relationship release remote removed reported reputation restoration security senders sessions several shadow signatures significant simple since sized small social someone spearphishing spot status suggested targets templates tests thought through times training treat trw32/filecoder trw32/phobos types unrecognized/untrusted unwanted updated used user users using variant variants various vendor vulnerabilities vulnerable w32/generic what why wild within xiii |
| Tags | Ransomware |
| Stories | |
| Notes | ★★★★★ |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.