Ransomware Defense Using the Wazuh Open Source Platform
Summary: Wazuh is a free, open source XDR and SIEM platform that detects ransomware through threat detection rules, a custom database list, File Integrity Monitoring, and integrations with YARA and VirusTotal. The article walks through two variants: DOGE Big Balls, a modified FOG ransomware delivered via phishing or unpatched vulnerabilities that performs privilege escalation, reconnaissance, and file encryption, and Gunra, which appends the .ENCRT extension, leaves R3ADM3.txt notes, deletes shadow copies, disables backup and antivirus services, and uses Tor.
What you should know: Gunra deletes shadow copies and disables backup and antivirus services before encrypting, so recovery depends on snapshots taken ahead of the attack - which the article shows Wazuh automating through the Windows Volume Shadow Copy Service. Ransom demands in the source range from hundreds to millions of dollars with no guarantee of data recovery even after payment.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Related