• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
latest lockbit ransomware strain 'strikingly similar' to blackmatter

Latest LockBit ransomware strain ‘strikingly similar’ to BlackMatter

You are here: Home / General Cyber Security News / Latest LockBit ransomware strain ‘strikingly similar’ to BlackMatter
July 4, 2022

IT Pro

Security scientists have acquired a sample of the hottest ransomware pressure from the LockBit group and stated the code bears putting resemblance to that of BlackMatter.

LockBit 3. was only launched in late June 2022 this means this is a person of the 1st times the new pressure has been accessible for evaluation.

✔ Approved From Our Partners
AOMEI Backupper Lifetime

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code


Fabian Wosar, head of ransomware analysis at Emsisoft, claimed “large portions of the code are ripped straight from BlackMatter/Darkside. [I] Guess it is apparent that LockBit bought their soiled palms on an additional group’s code.”

The sample in query is the 3rd pressure of ransomware from LockBit but is called ‘LockBit Black’ by the ransomware group. Wosar explained the identify given to the new pressure internally is fitting offered the similarities concerning it and BlackMatter.

The BlackMatter team developed the eponymous ransomware method that succeeded the DarkSide hacking group. DarkSide is most well known for attacking Colonial Pipeline previous yr and eventually shutting down before long soon after owing to the robust national security reaction from the US.

Wosar also said that “there was an unconfirmed rumour” that BlackMatter fired its developers following his workforce at Emsisoft identified a flaw that authorized victims to decrypt their files. 

Simply because of this and the similarities in code, he said “it would appear reasonable” that LockBit hired the previous BlackMatter builders to operate on LockBit 3..

LockBit has been in operation given that 2019 and has regularly been just one of the most popular ransomware threats in the cyber security landscape considering the fact that. In Might 2022, LockBit 2. was accountable for 40% of all ransomware incidents that thirty day period, in accordance to NCC Group.

According to the LockBit 3. ransom notice, the team consider the latest pressure as “the world’s quickest and most steady ransomware” in existence. 

Malware researcher Arda Büyükkaya also analysed the hottest sample. As part of his vital original findings, he learned that the sample uses anti-evaluation approaches – not unheard of with modern ransomware – and it will not execute devoid of a password, significantly like the BlackCat ransomware. 

Büyükkaya claimed he obtained the sample for evaluation via an incident reaction scenario his team is doing the job on which noticed the attackers obtain the victim’s device via distant desktop protocol (RDP).

Presented how not long ago the pressure was introduced, supplemental details about the plan continues to be unclear but researchers generally endeavor to reverse engineer samples this sort of as these and supply no cost decryptors to cease companies from paying ransoms. 

LockBit is a double extortion ransomware team and the product has grown in recognition amongst cyber prison outfits to assure productive bacterial infections outcome in a payment. 

The field however advises businesses to hardly ever spend ransoms and get well data files from backups wherever feasible. Ransomware gangs are ever more getting to thieving files right before locking victims out of their devices as an additional measure to guarantee payment is designed relatively than basically recovering from backups.

Knowledge safety restrictions these as GDPR stipulate that businesses that drop significant amounts of particular details on people today encounter huge fines. Not spending the ransom could final result in a larger decline via regulatory fines than the ransom alone.

LockBit’s bug bounty

In addition to releasing a new ransomware pressure not long ago, the LockBit workforce also announced the launch of its bug bounty application – believed to be the first of its sort provided by a ransomware outfit.

“We invite all security researchers, ethical and unethical hackers on the world to take part in our bug bounty system,” it said on its web-site. “The sum of remuneration differs from $1,000 to $1 million.”

The group exclusively claimed it’s hunting for XSS vulnerabilities, MySQL injections, and immediate shells in websites, but will shell out for any bug that could assist its goals. The monetary amount will rely on the severity of the bug, it stated.

It will also shell out particularly $1 million to the particular person who can present the whole title of the LockBit affiliate supervisor in a non-public concept on the Tox Chat platform.

Additional bugs that are eligible for a payout are vulnerabilities in the Tox Chat messenger, the TOR browser, or just frequently fantastic concepts that could assistance LockBit make improvements to its software package. 


Some pieces of this write-up are sourced from:
www.itpro.co.uk

Previous Post: «Cyber Security News ICO Set to Scale Back Public Sector Fines
Next Post: HackerOne employee fired for using position to steal bug bounties hackerone employee fired for using position to steal bug bounties»

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month
  • Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion
  • CTEM is the New SOC: Shifting from Monitoring Alerts to Measuring Risk
  • Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware
  • WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network
  • New TokenBreak Attack Bypasses AI Moderation with Single-Character Text Changes
  • AI Agents Run on Secret Accounts — Learn How to Secure Them in This Webinar
  • Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction
  • Non-Human Identities: How to Address the Expanding Security Risk
  • ConnectWise to Rotate ScreenConnect Code Signing Certificates Due to Security Risks

Copyright © TheCyberSecurity.News, All Rights Reserved.