Now that the second wave of sabotage has begun, the researcher released the source code of the Conti ransomware.
Malware
Using the Diavol ransomware decryptor tool, users can decrypt files encrypted by Diavol for free, and the encrypted file formats include .lock64 and so on
Once the device is successfully compromised, B1txor20 Linux backdoor utilizes the DNS tunnel to retrieve and execute commands sent by the server
Microsoft Defender for Endpoint incorrectly flagged Microsoft Office updates as malicious, saying a potential ransomware behavior
hackers are not using normal software to sign, and security researchers have found multiple pieces of malware that carry Nvidia's code-signing certificate
Previously, Nvidia suffered a ransomware attack by a hacker group, and its internal systems were compromised
Asustor, a NAS server manufacturer under ASUS, has been attacked by Deadbolt ransomware, and many users have reported on the ASUS Technology forum
Criminals also saw an opportunity in this case, and the gang behind the RedLine malware started creating fake upgrades to lure users into downloading
DeadBolt ransomware is looking for exposed NAS on the network, and then looking for potential vulnerabilities to try to launch an attack
Google has previously issued a policy change reminder, and if users store or use files with security issues in Google Drive, a banner warning will pop up
Malicious KMSPico installers mainly embeds malicious software in the activator and then distributes it through the Internet and software forums.
According to the report, 86% of the 50 Google Cloud instances recently attacked were used to perform cryptocurrency mining.
Emotet is now making a comeback with the help of TrickBot malware, and researchers are currently paying close attention to the development of Emotet