31–40 of 435 posts
A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...
As someone affected by the ransomware - did anyone else notice empty console windows popping up from time to time the days before the ransomware triggered the encryption?
> with WannaCry it was alleged a nation state was likely responsible for spreading the malware: North Korea Is there any evidence for this? Looks like another fake rumor.
It basically comes to it looking like Lazarus Group
The WannaCry attacks used the same command-and-control server used in the North Korean hack of Sony Pictures Entertainment in 2014, which wiped out nearly half of the company’s personal computers and servers.
...
Other digital crumbs linking the North Korean group to WannaCry include a tool that deletes data that had been used in other Lazarus attacks. The hackers behind WannaCry also used a rare encryption method and an equally unusual technique to cover their tracks.
As someone affected by the ransomware - did anyone else notice empty console windows popping up from time to time the days before the ransomware triggered the encryption?
Earlier quoted context omitted.
As if this attack purely relied on people clicking on emails. Maybe that's 1 person out of 10.000 but obviously this used various other methods to spread.
how else could it spread? flash exploit? Skype? Wanna cry spread to computer connected to network but individuals at home probably aren't connected to a local network unless there are multiple computers
Ransomeware used to be purely trojans, but newer iterations now come with a viral component based (at least partially) on that leaked NSA toolkit.
> with WannaCry it was alleged a nation state was likely responsible for spreading the malware: North Korea Is there any evidence for this? Looks like another fake rumor.
Security researchers matched parts of the WannaCry code to previous viruses that were thought to originate from NK. Of course they also said anyone could of copied and pasted the code and just made it look like that, but the media ignored that part.
> [...]
> Grooten went on to say, "BTW, 'North Korea' may well be a foreign hacker group paid by them."
https://arstechnica.com/security/2017/05/virulent-wcry-ranso...
A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...
What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.
company I work for disabled all working from home VPN accounts for the time being until we do a security audit
A friend sent me the bitcoin address, they've already collected 2600$. [EDIT] Now 3230$ Source: https://blockchain.info/address/1Mz7153HMuxXTuR2R1t78mGSdzaA...
What a clickbait headline. A paltry $3k and yet the article calls this a "MASSIVE ransomware outbreak". I would be curious to see what a "minor" outbreak is.
Earlier quoted context omitted.
That's not enough anymore: good ransomware will look for backup systems and wipe those out before proceeding. You need read-only, airgapped backups before you can consider yourself safe.
That doesn't help for targeted attacks, which corrupt the backups as they are being written. Not sure how to protect against that though.
Not sure about Spideroak but in the case of rsync.net they duplicate snapshots and store them outside of your main account so even if your account gets compromised and an attacker deletes all your backups you're still safe.
Earlier quoted context omitted.
That's not enough anymore: good ransomware will look for backup systems and wipe those out before proceeding. You need read-only, airgapped backups before you can consider yourself safe.
how can they infect an external drive that backed up the data before the infection?