Sam Sam: The Doctor Will See You, After He Pays The Ransom
Summary: Cisco Talos observed a widespread SamSam ransomware campaign that spreads by compromising servers, often JBoss application servers via the open-source JexBoss tool, then moving laterally to encrypt Windows systems rather than arriving through phishing or exploit kits. The malware encrypts files with Rijndael and RSA-2048, aborts on Windows versions prior to Vista, shows no beaconing or C2 activity, and ransom prices rose from 1 bitcoin per PC to 1.5 and later 1.7 bitcoin, with a 22-bitcoin bulk option and wallets holding at least ~275 bitcoin (~$115,000 USD).
What you should know: The adversaries did not disguise the ransomware, yet the campaign was profitable enough to raise prices from 1 to 1.7 bitcoin per machine - and Talos notes victims often find backups non-existent or incomplete exactly when they are needed, which is the revenue stream funding this development.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026