{"id":7206,"date":"2022-09-23T06:48:40","date_gmt":"2022-09-23T13:48:40","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7206"},"modified":"2023-04-20T01:43:39","modified_gmt":"2023-04-20T08:43:39","slug":"securins-threat-intelligence-september-19-2022-september-23-2022","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-september-19-2022-september-23-2022\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: September 19, 2022 to September 23, 2022"},"content":{"rendered":"<p dir=\"ltr\" style=\"text-align: justify;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">Why play catchup when you can fix this now?<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">Trending Threats<\/p>\n<ul dir=\"ltr\" style=\"text-align: justify;\">\n<li>Bitdefender Introduces a Decryptor Tool for the LockerGoga Ransomware<\/li>\n<li>More Information on Ragnor Locker Ransomware<\/li>\n<\/ul>\n<h2 dir=\"ltr\" style=\"text-align: justify;\">Trending Threats<\/h2>\n<h3 dir=\"ltr\" style=\"text-align: justify;\"><a id=\"Bitdefender Introduces a Decryptor Tool for the LockerGoga Ransomware\" name=\"Bitdefender Introduces a Decryptor Tool for the LockerGoga Ransomware\"><\/a>Bitdefender Introduces a Decryptor Tool for the LockerGoga Ransomware<\/h3>\n<p dir=\"ltr\" style=\"text-align: justify;\">Bitdefender\u2014in collaboration with law enforcement agencies, including Europol, the No More Ransom Project, the Z\u00fcrich Public Prosecutor&#8217;s Office, and the Cantonal Police of Z\u00fcrich\u2014has developed a free decryptor tool to recover files encrypted by the LockerGoga ransomware. The free tool and a\u00a0<a href=\"https:\/\/www.nomoreransom.org\/uploads\/LockerGoga-Decrypt-Doc.pdf\">user guide<\/a>\u00a0are available for download from Bitdefender\u2019s servers.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">LockerGoga is a ransomware group that has been operational since January 2019 and has attacked prominent organizations all over the world. It is estimated that the group has caused damages worth $US 104 million with its activities. Twelve members of the group were arrested in October 2021, causing the group\u2019s operations to cease.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">The free tool is expected to be used by victims, whose files are still encrypted, of the LockerGoga group.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\"><em><strong>CVE-2019-3396 is the CVE targeted by the LockerGoga group.<\/strong><\/em><\/p>\n<h3 dir=\"ltr\" style=\"text-align: justify;\"><a id=\"More Information on Ragnor Locker Ransomware\" name=\"More Information on Ragnor Locker Ransomware\"><\/a>More Information on the Ragnor Locker Ransomware<\/h3>\n<p dir=\"ltr\" style=\"text-align: justify;\">Ragnor Locker has been making headlines in the news with its\u00a0<a href=\"https:\/\/cybersecurityworks.com\/blog\/cyber-risk\/csws-threat-intelligence-august-29-2022-september-2-2022.html#Ragnar%20Locker%20Ransomware\">attacks\u00a0<\/a>on Air Portugal, DESFA, etc.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">There is now more information about how this ransomware group operates. The attacks are carried out on Windows and Linux systems where a compromised machine is used to gather information and also encrypt files using the Salsa 20 encryption algorithm. Once this is done, the group employs the double extortion tactic to get ransom from their victims\u2014to decrypt the files and not publish the stolen information to the public.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">The Ragnor Locker ransomware also deletes volume shadow copies and terminates services, such as VSS, SQL, Veeam, LogMeIN, etc., to keep the victim from recovering the affected files.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">CVE-2017-0213 (Windows COM Elevation of Privilege Vulnerability) is a vulnerability that Ragnor Locker exploits. It uses the RDP services exposed to the internet to compromise victim machines with brute-forcing techniques and leaked credentials<\/p>\n<p style=\"text-align: justify;\">The FBI <a href=\"https:\/\/www.ic3.gov\/Media\/News\/2022\/220307.pdf\">warned organizations<\/a>\u00a0against Ragnor Locker in March 2022.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\"><em>Check out this section to track how these threats evolve!<\/em><\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">We use our threat intelligence platform driven by Artificial Intelligence (AI) and Machine Learning (ML) models to analyze the vulnerabilities that hackers could potentially exploit. We warn our customers continuously about exposures and prioritize vulnerabilities to facilitate rapid remediation.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">Follow our weekly blog and podcast to get proactive alerts on trending threats. Reach out to us if you need help managing your vulnerabilities and exposures.<\/p>\n<p dir=\"ltr\" style=\"text-align: justify;\">Leverage our expertise and manage your threats continuously to stay safe from attackers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[576,578,577,145,91,103],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7206"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=7206"}],"version-history":[{"count":18,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7206\/revisions"}],"predecessor-version":[{"id":17871,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/7206\/revisions\/17871"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=7206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=7206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=7206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}