{"id":15553,"date":"2019-06-12T09:10:02","date_gmt":"2019-06-12T17:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/06\/12\/news-9302\/"},"modified":"2019-06-12T09:10:02","modified_gmt":"2019-06-12T17:10:02","slug":"news-9302","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/06\/12\/news-9302\/","title":{"rendered":"MegaCortex continues trend of targeted ransomware attacks"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Wed, 12 Jun 2019 16:03:25 +0000<\/strong><\/p>\n

MegaCortex is a relatively new ransomware family that continues the 2019 trend of threat actors developing ransomware specifically for targeted attacks on enterprises. While GandCrab apparently shut its doors, several other bespoke, artisanal ransomware families have taken its place, including RobinHood<\/a>, which shut down the city of Baltimore, Troldesh<\/a>, and CrySIS\/Dharma<\/a>.<\/p>\n

Detected by Malwarebytes as Ransom.MegaCortex, MegaCortex saw a spike in business detections in late May and has since slowed down to a trickle, following a similar trend as its Troldesh and CrySIS forebearers.<\/p>\n

\"malwarebytes<\/figure>\n

Our anti-ransomware technology detected Ransom.MegaCortex even before defintions were added.<\/p>\n

\"generic<\/figure>\n

Distribution<\/h3>\n

The methods of distribution for MegaCortex are still not completely clear, but there are indications that the ransomware is dropped on compromised computers by using Trojan downloaders. Once a corporate network has been compromised, the attackers try to gain access to a domain controller and spread across the entire network from there.<\/p>\n

Suspected Trojans that might be responsible for the distribution of MegaCortex are Qakbot aka Qbot<\/a>, Emotet<\/a>, and Rietspoof<\/a>. Rietspoof is a multi-stage malware that spreads through instant messaging programs.<\/p>\n

Execution<\/h3>\n

Before the actual ransomware process starts, several tools and scripts are deployed to disable certain security processes and attempt to gain access to the domain controller so the ransomware can be distributed across the network.<\/p>\n

Once the ransomware process is activated, it creates these files:<\/p>\n