InfoSecBulletin Cybersecurity for mankind
The SonicWall Capture Labs threat research team recently observed a new variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file encryption code.
StopCrypt, also known as STOP Djvu, is a widely spread ransomware, as reported by BleepingComputer. Unlike other ransomware that focuses on big corporations, StopCrypt specifically targets everyday users.
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
This malware is spread through websites used for sharing copyrighted software. When you download the software, the malware is also downloaded.
This malware isn’t new, it has been around since 2018, but it has evolved over the years to be harder to detect.
The new version of this malware is more complex and difficult to detect because it uses multiple stages of execution. It also utilizes API calls on the stack to allocate memory.
The malware will take control of other processes and run its code in the background.
Malware can modify access control lists, preventing users from deleting crucial malware files and directories.
Once everything is done, you will receive a _readme.txt message in each directory with instructions on how to unlock your files.
This malware has been a problem for years. To stay safe, be vigilant and avoid shady websites.
Ransomware is a big threat. It stole data from 27,000 people at Stanford. There are other malwares causing trouble, and a recent one is Vcrums malware targeting browsers.
