Sam Sam - The Evolution Continues Netting Over $325,000 in 4 Weeks
Summary: Cisco Talos reported a new SamSam ransomware variant hitting government, healthcare and ICS organizations, with attackers receiving roughly 30.4 BTC, equal to $325,217.07, into a single wallet whose first payment arrived on 25 December 2017. The variant uses a loader called "runner" that decrypts and executes an encrypted .NET payload, adds DES string obfuscation and other anti-analysis techniques, and is deployed manually, while the initial infection vector remains unknown.
Key Takeaway: The same wallet address, 1MddNhqRCJe825ywjdbjbAQpstWBpKHmFR, is shared across multiple infected victims, and the attackers offer free decryption of two files and one server to prove they can still move through the network - a reminder that payment buys nothing but the adversary's word.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026