CTB-Locker Ransomware Spreading Rapidly, Infects Thousands of Web Servers
Summary: A variant of CTB-Locker called CTB-Locker for Websites is targeting web servers directly, encrypting site content with AES-256 and a unique key per site, then replacing index.php or index.html with a ransom page. The demand is 0.4 Bitcoin with a deadline, rising to 0.8 Bitcoin if unpaid, and the operators decrypt two randomly selected files free to prove recovery is possible.
What you should know: Because encryption happens server-side, endpoint antivirus on user machines offers no protection, and a single compromised server can take down a site's transactions and customer access at once.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·