Latest Encryptor news

LockBit ransomware returns to attacks with new encryptors, servers

The LockBit ransomware gang is once again conducting attacks, using updated encryptors with ransom notes linking to new servers after last week's law enforcement disruption.
- Lawrence Abrams
- February 28, 2024
- 01:31 PM
- 0
LockBit ransomware secretly building next-gen encryptor before takedown

LockBit ransomware developers were secretly building a new version of their file encrypting malware, dubbed LockBit-NG-Dev - likely a future LockBit 4.0, when law enforcement took down the cybercriminal's infrastructure earlier this week.
- Bill Toulas
- February 22, 2024
- 08:51 AM
- 0
Linux version of Qilin ransomware focuses on VMware ESXi

A sample of the Qilin ransomware gang's VMware ESXi encryptor has been found and it could be one of the most advanced and customizable Linux encryptors seen to date.
- Lawrence Abrams
- December 03, 2023
- 04:07 PM
- 0
VX-Underground malware collective framed by Phobos ransomware

A new Phobos ransomware variant frames the popular VX-Underground malware-sharing collective, indicating the group is behind attacks using the encryptor.
- Lawrence Abrams
- November 20, 2023
- 03:42 PM
- 0
HelloKitty ransomware source code leaked on hacking forum

A threat actor has leaked the complete source code for the first version of the HelloKitty ransomware on a Russian-speaking hacking forum, claiming to be developing a new, more powerful encryptor.
- Lawrence Abrams
- October 09, 2023
- 08:25 AM
- 0
The Week in Ransomware - August 18th 2023 - LockBit on Thin Ice

While there was quite a bit of ransomware news this week, the highlighted story was the release of Jon DiMaggio's third article in the Ransomware Diaries series, with the focus of this article on the LockBit ransomware operation.
- Lawrence Abrams
- August 18, 2023
- 05:07 PM
- 0
Microsoft: BlackCat's Sphynx ransomware embeds Impacket, RemCom

Microsoft has discovered a new version of the BlackCat ransomware that embeds the Impacket networking framework and the Remcom hacking tool, both enabling spreading laterally across a breached network.
- Lawrence Abrams
- August 17, 2023
- 06:05 PM
- 0
Monti ransomware targets VMware ESXi servers with new Linux locker

The Monti ransomware has returned to action after a two-month hiatus, now targeting primarily legal and government organizations, and VMware ESXi servers using a new Linux variant that is vastly different from its predecessors.
- Bill Toulas
- August 14, 2023
- 12:12 PM
- 0
Linux version of Abyss Locker ransomware targets VMware ESXi servers

The Abyss Locker operation is the latest to develop a Linux encryptor to target VMware's ESXi virtual machines platform in attacks on the enterprise.
- Lawrence Abrams
- July 29, 2023
- 11:17 AM
- 0
Meet NoEscape: Avaddon ransomware gang's likely successor

The new NoEscape ransomware operation is believed to be a rebrand of Avaddon, a ransomware gang that shut down and released its decryption keys in 2021.
- Lawrence Abrams
- July 17, 2023
- 10:15 AM
- 0
Royal ransomware gang adds BlackSuit encryptor to their arsenal

The Royal ransomware gang has begun testing a new encryptor called BlackSuit that shares many similarities with the operation's usual encryptor.
- Lawrence Abrams
- June 08, 2023
- 03:12 AM
- 0
Linux version of RTM Locker ransomware targets VMware ESXi servers

RTM Locker is the latest enterprise-targeting ransomware operation found to be deploying a Linux encryptor that targets virtual machines on VMware ESXi servers.
- Bill Toulas
- April 27, 2023
- 12:20 PM
- 1
LockBit ransomware encryptors found targeting Mac devices

The LockBit ransomware gang has created encryptors targeting Macs for the first time, likely becoming the first major ransomware operation to ever specifically target macOS.
- Lawrence Abrams
- April 16, 2023
- 01:31 PM
- 7
IceFire ransomware now encrypts both Linux and Windows systems

Threat actors linked to the IceFire ransomware operation are now actively targeting Linux systems worldwide with a new dedicated encryptor.
- Sergiu Gatlan
- March 09, 2023
- 09:00 AM
- 2
LockBit ransomware goes 'Green,' uses new Conti-based encryptor

The LockBit ransomware gang has again started using encryptors based on other operations, this time switching to one based on the leaked source code for the Conti ransomware.
- Lawrence Abrams
- February 01, 2023
- 05:48 PM
- 0
Ransom Cartel linked to notorious REvil ransomware operation

Threat analysts have connected the pieces that link the Ransom Cartel RaaS (ransomware-as-a-service) to the REvil gang, one of the most notorious and prolific ransomware groups in recent years.
- Bill Toulas
- October 18, 2022
- 05:49 PM
- 0
LockBit ransomware builder leaked online by "angry developer"

The LockBit ransomware operation has suffered a breach, with an allegedly disgruntled developer leaking the builder for the gang's newest encryptor.
- Lawrence Abrams
- September 21, 2022
- 02:07 PM
- 0
Cuba ransomware returns to extorting victims with updated encryptor

The Cuba ransomware operation has returned to regular operations with a new version of its malware found used in recent attacks.
- Bill Toulas
- June 08, 2022
- 10:55 AM
- 0
Beware: Onyx ransomware destroys files instead of encrypting them

A new Onyx ransomware operation is destroying large files instead of encrypting them, preventing those files from being decrypted even if a ransom is paid.
- Lawrence Abrams
- April 27, 2022
- 08:16 PM
- 0
Hive ransomware ports its Linux VMware ESXi encryptor to Rust

The Hive ransomware operation has converted their VMware ESXi Linux encryptor to the Rust programming language and added new features to make it harder for security researchers to snoop on victim's ransom negotiations.
- Lawrence Abrams
- March 27, 2022
- 03:18 PM
- 0