The ransomware group known as REvil or Sodinokibi has adopted two new strategies to guarantee success in extorting ransom money from its victims, including conducting DDoS attacks and voice calling victims and their business partners, according to Bleeping Computer. The group in February announced a recruitment drive for hackers with knowledge of these procedures, which include Layer 3 and Layer 7 DDoS attacks and voice scrambled VOIP calls to journalists and victims’ partners, with the intent of putting more pressure on victims to pay the ransom, and the operation officially announced plans to use these tactics last week. REvil is providing the voice calls as a free service to affiliates and the DDoS attacks as a paid service. REvil’s ransomware-as-a-service attacks typically earn the group between 20-30% of the ransom money, while the remaining 70-80% go to affiliates. Several other ransomware operations have started to conduct DDoS attacks against victims as part of their operations, including SunCrypt and Ragnar Locker, and the ransomware group Avaddon in January.
Jill Aitoro leads editorial for SC Media, and content strategy for parent company CyberRisk Alliance. She 20 years of experience editing and reporting on technology, business and policy.
Security Affairs reports that attacks with the novel Cuttlefish malware have been deployed against enterprise-grade small office/home office routers between October 2023 and April 2024 to facilitate the exfiltration of public cloud authentication information.
Reemergent Zloader trojan has been updated once again by its operators to include an anti-analysis feature restricting binary execution to compromised machines, which is similar to one observed in exposed Zeus banking trojan 2.x source code, according to The Hacker News.
BleepingComputer reports that hacked WordPress sites have been used as relay command-and-control servers by the novel Wpeeper Android malware, which has been spread via a pair of app stores impersonating the Uptodown App Store and is believed to have already compromised thousands of Android devices.