InfoSecBulletin Cybersecurity for mankind
The SonicWall Capture Labs threat research team recently observed a new variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file encryption code.
StopCrypt, also known as STOP Djvu, is a widely spread ransomware, as reported by BleepingComputer. Unlike other ransomware that focuses on big corporations, StopCrypt specifically targets everyday users.
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
This malware is spread through websites used for sharing copyrighted software. When you download the software, the malware is also downloaded.
This malware isn’t new, it has been around since 2018, but it has evolved over the years to be harder to detect.
The new version of this malware is more complex and difficult to detect because it uses multiple stages of execution. It also utilizes API calls on the stack to allocate memory.
The malware will take control of other processes and run its code in the background.
Malware can modify access control lists, preventing users from deleting crucial malware files and directories.
Once everything is done, you will receive a _readme.txt message in each directory with instructions on how to unlock your files.
This malware has been a problem for years. To stay safe, be vigilant and avoid shady websites.
Ransomware is a big threat. It stole data from 27,000 people at Stanford. There are other malwares causing trouble, and a recent one is Vcrums malware targeting browsers.
