A new ransomware-as-a-service called SophosEncrypt is impersonating the well-known cybersecurity vendor, Sophos. The threat actors have cleverly adopted the company’s name to carry out their operation.
Yesterday, the ransomware was discovered by Malware Hunter Team. At first, Sophos believed it was a component of a red team exercise. The encryptor was not created by the Sophos X-Ops team, as confirmed by their recent tweet. They are currently carrying out an investigation into its release.
The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
“We found this on VT earlier and have been investigating. Our preliminary findings shows Sophos InterceptX protects against these ransomware samples,” tweeted Sophos.
Sophos X-Ops tweet
ID Ransomware has identified a submission from an infected victim as evidence that the Ransomware-as-a-Service operation is happening actively.
Although the specifics of the RaaS operation and its promotion remain largely unknown, Malware Hunter Team stumbled upon a sample of the encryptor, providing us with a valuable glimpse into its inner workings.