Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bucbi Ransomware Is Back With a Ukrainian Makeover

Summary: Palo Alto Networks researchers observed attackers brute-forcing RDP accounts on Internet-facing Windows servers to deliver an updated Bucbi ransomware, a family dating to early 2014, with five IP addresses seen attacking a victim machine starting in late March 2016. The new variant drops the HTTP command-and-control channel, no longer requires an Internet connection, adds network-resource encryption, and leaves ransom notes claiming the "Ukrainian Right Sector," though Russian PE resources and Russian-language files in the attack leave attribution unresolved.

What you should know: The attackers used point-of-sale-specific usernames in their RDP brute force, suggesting they were hunting PoS devices and only pivoted to ransomware after finding the compromised machine did not process transactions - and the sample includes a decryption routine that a simple binary modification can invoke, letting victims recover files without paying.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related