Novel LostTrust ransomware operation emerges

BleepingComputer reports that 53 organizations around the world have already been compromised by the new LostTrust ransomware operation since it commenced attacks in March. LostTrust has been suspected to be a MetaEncryptor ransomware rebrand due to nearly identical data leak sites and Windows encryptors. Both ransomware gangs were discovered by cybersecurity researcher Stefano Favarato to be leveraging the same template and bio for their sites, with the operations touting their members to be network security specialists with 15 years or more experience. Moreover, only slight differences in ransom notes, note names, embedded public keys, and encrypted file extensions were found between LostTrust and MetaEncryptor, with MalwareHunterTeam noting that the SFile2 ransomware encryptor was used as the basis by both operations. Further examination of the LostTrust encryptor revealed that execution would prompt the disabling of various Windows services, as well as the deactivation of other Microsoft Exchange-related services prior to encryption. Ransom notes by the operation suggest that members were once ethical hackers that transitioned to cybercrime after poor compensation.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.