Evolution of Sam Sa Malware Suggests New Ransomware Tactics In Play
Summary: Palo Alto Networks analyzed 23 samples of the SamSa ransomware family, first compiled December 9, 2015, and traced 166.422305 Bitcoin in payments to the attacker, roughly $70,000 USD at the time (Cisco Talos put the figure closer to $115,000). The malware is deployed manually after an attacker gains network access and moves laterally, using utilities such as PSExec, an RSA public key generated per attack, and a batch script that deletes volume shadow copies and then self-destructs.
Bottom line: Two 40 BTC payments landed on February 3 and 5, around the time Hollywood Presbyterian Medical Center met a 40 BTC demand, and payment notes referenced strings beginning 'HPM' - a reminder that a single negotiated lump sum can fund an operation across many victims.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026