Search cyberveille.decio.ch

LockBit Ransomware v4.0

Malware Analysis Report - LockBit Ransomware v4.0 In this blog post, I’m going over my analysis for the latest variant of LockBit ransomware - version 4.0. Throughout this blog, I’ll walk through all the malicious functionalities discovered, complete with explanations and IDA screenshots to show my reverse engineering process step by step. This new version of LockBit 4.0 implements a hybrid-cryptography approach, combining Curve25519 with XChaCha20 for its file encryption scheme. This version shares similarities with the older LockBit Green variant that is derived from Conti ransomware. While the multi-threading architecture seems more streamlined than previous versions, it still delivers an encryption speed that outpaces most other ransomware families. As always, LockBit is still my most favorite malware to look at, and I certainly enjoyed doing a deep dive to understand how this version works.

#chuongdong #EN #2025 #Malware #Analysis #Report #LockBit #LockBit4.0 #ransomware

·chuongdong.com·Apr 30, 2025

LockBit Ransomware v4.0

Ransomware gang targets IT workers with new SharpRhino malware

The Hunters International ransomware group is targeting IT workers with a new C# remote access trojan (RAT) called SharpRhino to breach corporate networks.

#bleepingcomputer #EN #2024 #Hunters-International #Malware #Ransomware #SharpRhino #Typo-Squatting

·bleepingcomputer.com·Aug 6, 2024

Ransomware gang targets IT workers with new SharpRhino malware

Black Basta ransomware switches to more evasive custom malware

The Black Basta ransomware gang has shown resilience and an ability to adapt to a constantly shifting space, using new custom tools and tactics to evade detection and spread throughout a network.

#bleepingcomputer #EN #2024 #BlackBasta #Initial-Access #Malware #Ransomware #mandiant #UNC4393

·bleepingcomputer.com·Aug 3, 2024

Black Basta ransomware switches to more evasive custom malware

Rafel RAT, Android Malware from Espionage to Ransomware Operations

Android, Google’s most popular mobile operating system, powers billions of smartphones and tablets globally. Known for its open-source nature and flexibility, Android offers users a wide array of features, customization options, and access to a vast ecosystem of applications through the Google Play Store and other sources. However, with its widespread adoption and open environment comes the risk of malicious activity. Android malware, a malicious software designed to target Android devices, poses a significant threat to users’ privacy, security, and data integrity. These malicious programs come in various forms, including viruses, Trojans, ransomware, spyware, and adware, and they can infiltrate devices through multiple vectors, such as app downloads, malicious websites, phishing attacks, and even system vulnerabilities.

#checkpoint #EN #2024 #Rafel #RAT #Android #Malware #Ransomware #Operations

·research.checkpoint.com·Jun 24, 2024

Rafel RAT, Android Malware from Espionage to Ransomware Operations

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Leaked LockBit builder in a real-life incident response case | Securelist

Kaspersky researchers revisit the leaked LockBit 3.0 builder and share insights into a real-life incident involving a custom targeted ransomware variant created with this builder.

#securelist #EN #2024 #builder #Data-Encryption #Incident-response #LockBit #Malware #Malware-Technologies #Ransomware #Targeted-attacks #Trojan

·securelist.com·Apr 16, 2024

Leaked LockBit builder in a real-life incident response case | Securelist

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

New RustDoor macOS malware impersonates Visual Studio update

A new Rust-based macOS malware spreading as a Visual Studio update to provide backdoor access to compromised systems uses infrastructure linked to the infamous ALPHV/BlackCat ransomware gang.

#bleepingcomputer #EN #2024 #ALPHV #Backdoor #BlackCat #Data-Exfiltration #macOS #Malware #Ransomware

·bleepingcomputer.com·Feb 9, 2024

New RustDoor macOS malware impersonates Visual Studio update

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Ransomware Attacks Have Entered a ‘Heinous’ New Phase

With victims refusing to pay, cybercriminal gangs are now releasing stolen photos of cancer patients and sensitive student records.

#wired #EN #2023 #ransomware #security #crime #malware #Heinous

·wired.com·Mar 14, 2023

Ransomware Attacks Have Entered a ‘Heinous’ New Phase

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

Since December 2022, Cisco Talos has been observing an unidentified actor deploying two relatively new threats, the recently discovered MortalKombat ransomware and a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims.

#talosintelligence #EN #2023 #MortalKombat #ransomware #Laplas #Clipper #malware #threats

·blog.talosintelligence.com·Feb 14, 2023

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

Stolen certificates in two waves of ransomware and wiper attacks | Securelist

In this report, we compare the ROADSWEEP ransomware and ZEROCLEARE wiper versions used in two waves of attacks against Albanian government organizations.

#securelist #2022 #EN #Malware #Malware-Descriptions #Malware-Technologies #Ransomware #Targeted-attacks #Trojan #Wiper #Albania

·securelist.com·Dec 22, 2022

Stolen certificates in two waves of ransomware and wiper attacks | Securelist

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks

Conti vs. LockBit: A Comparative Analysis of Ransomware Groups

We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022.

#trendmicro #EN #2022 #Conti #Lockbit #malware #cyber-crime #research #cyber-threats #endpoints #ransomware #articles #news #reports

·trendmicro.com·Jun 28, 2022

Conti vs. LockBit: A Comparative Analysis of Ransomware Groups

TrickBot malware operation shuts down, devs move to BazarBackdoor

The TrickBot malware operation has shut down after its core developers move to the Conti ransomware gang to focus development on the stealthy BazarBackdoor and Anchor malware families.

#BazarBackdoor #Conti #Malware #Ransomware #TrickBot #2002 #EN #bleepingcomputer

·bleepingcomputer.com·Feb 26, 2022

TrickBot malware operation shuts down, devs move to BazarBackdoor

Ransomware Attacks Have Entered a ‘Heinous’ New Phase

With victims refusing to pay, cybercriminal gangs are now releasing stolen photos of cancer patients and sensitive student records.

#wired #EN #2023 #ransomware #security #crime #malware #Heinous

·wired.com·Mar 14, 2023

Ransomware Attacks Have Entered a ‘Heinous’ New Phase

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

Since December 2022, Cisco Talos has been observing an unidentified actor deploying two relatively new threats, the recently discovered MortalKombat ransomware and a GO variant of the Laplas Clipper malware, to steal cryptocurrency from victims.

#talosintelligence #EN #2023 #MortalKombat #ransomware #Laplas #Clipper #malware #threats

·blog.talosintelligence.com·Feb 14, 2023

New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated campaign

Stolen certificates in two waves of ransomware and wiper attacks | Securelist

In this report, we compare the ROADSWEEP ransomware and ZEROCLEARE wiper versions used in two waves of attacks against Albanian government organizations.

#securelist #2022 #EN #Malware #Malware-Descriptions #Malware-Technologies #Ransomware #Targeted-attacks #Trojan #Wiper #Albania

·securelist.com·Dec 22, 2022

Stolen certificates in two waves of ransomware and wiper attacks | Securelist

Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.

#Evil-Corp #bleepingcomputer #EN #2022 #DEV-206 #DEV-243 #FakeUpdates #Malware #Ransomware #Raspberry-Robin #Worm

·bleepingcomputer.com·Jul 30, 2022

Microsoft links Raspberry Robin malware to Evil Corp attacks