yaracroft @venom@nanao.cybtex.fr

Newly discovered function in #DarkSide #ransomware variant targets disk partitions - At the time of discovery, FortiGuard Labs researchers believed the ransomware was seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files. But further analysis confirmed an even more advanced technique. This DarkSide variant seeks out partitions on a multi-boot system to find additional files to encrypt, thereby causing greater damage.

• DarkSide ransomware code is efficient and well-constructed, indicating that their cybercriminal organization includes experienced software engineers

• This ransomware variant (NOT the version used to disrupt Colonial Pipeline operations) is advanced in nature and was observed to seek out partitions in a multi-boot environment to create further damage. It also seeks out the domain controller and connects to its active directory via LDAP anonymous authentication.

• Additional insight on the files used by, and associated with, DarkSide was uncovered by the FortiGuard Incident Response team during recent engagements.

• The use of a well-known bulletproof host that has been used by a wide variety of malicious actors for numerous nefarious activities over the years, including the 2016 DNC elections attack in the United States.

https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions

Une partie des systèmes informatiques et téléphoniques du groupe français Stelliant (stelliant.com) partiellement paralysée suite à une attaque informatique. Créé en 1987, le Groupe Stelliant est un spécialiste des services à l'assurance. Les assureurs en ligne de mire. Récemment, les opérateurs du #ransomware #Avaddon a revendiqué une attaque sur une filiale asiatique du groupe international français AXA. Ils auraient exfiltrés plus de 3 téraoctets de données sensibles. Un timing qui fait suite à l'annonce de l'arrêt de la couverture du contrat #assurance « risques cyber » portant sur les ransomware.

https://www.newsassurancespro.com/cyber-le-groupe-stelliant-touche-par-une-attaque-informatique/01691455805

A never-before-documented Brazilian banking trojan, dubbed Bizarro, is targeting customers of 70 #banks scattered throughout #Europe & South America

https://securelist.com/bizarro-banking-trojan-expands-its-attacks-to-europe/102258/

Le système informatique de l'entreprise d'externalisation des affaires (BPO) iQera IO basée à Port Louis a été compromis. L'entreprise a partiellement paralysée par une infection de type ransomware.

https://defimedia.info/une-cyber-attaque-de-type-ransomware-detectee-port-louis

Hyntrospect, a fuzzer for Hyper-V devices

https://github.com/googleprojectzero/Hyntrospect