BleepingComputer reports that Windows, Linux, ARM, BSD, and ESXi systems have been subjected to attacks by the novel Russia-based VanHelsing ransomware-as-a-service operation, which has already compromised a Texas city and tech firms in the U.S. and France since its emergence earlier this month.
Organizations in Commonwealth of Independent States countries have been spared from VanHelsing's intrusions, which involve the deployment of a C++-based ransomware that leverages the ChaCha20 algorithm to facilitate total and partial encryption of files below and above the 1 GB threshold, respectively, according to an analysis from Check Point Research. VanHelsing also features a pair of encryption modes, with normal prompting file and folder enumeration, file content encryption, and file renaming, and stealth separating the encryption and file renaming processes, said researchers, who noted that the ransomware's code has been littered with exclusion list logic and file extension errors that signify its lack of maturity. Meanwhile, affiliates part of VanHelsing were found to have been given 80% of ransomware payments, which could reach up to $500,000.
An In-Depth Guide to Ransomware
Get essential knowledge and practical strategies to protect your organization from ransomware attacks.
The Hacker News disclosed that the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.
The UK's National Cyber Security Centre (NCSC) issued an alert regarding a new 'zero-click' threat campaign orchestrated by Russian state-backed hackers targeting organizations across critical sectors, according to a recent report by IT Pro.
