Microsoft SQL servers are succumbing to FARGO ransomware, security researchers at AhnLab Security Emergency Response Center (ASEC) have warned.
Alongside GlobeImposter, FARGO has become one of the most widespread ransomware that targets vulnerable MS-SQL servers, the company stated in a blog post. Statistical data from “ID Ransomware” attests to the burgeoning growth.
RELATED RESOURCE
How to reduce the risk of phishing and ransomware
Top security concerns and tips for mitigation
The strain was previously codenamed “Mallox” after analysts discerned the ransomware added a “.mallox” extension to encrypted files. Avast detailed the same strain in a report in February, labelling the ransomware “TargetCompany”.
Additionally, the cyber security firm released a decryption utility to help TargetCompany ransomware victims recover their files for free. However, the decryptor could only restore encrypted files under limited circumstances.
Decoding active exploits by FARGO ransomware, ASEC stated the strain causes a compromised machine to download a .NET file using cmd.exe and powershell.exe.
“The loaded malware generates and executes a BAT file which shuts down certain processes and services, in the %temp% directory,” added the company.
After injecting itself into AppLaunch.exe, the ransomware payload attempts to delete the registry key for the open-source ransomware vaccine Raccine. But that’s not all. The malware deactivates database processes and executes a recovery deactivation command to unencrypt confidential data.
“Administrators of MS-SQL servers should use passwords that are difficult to guess for their accounts and change them periodically to protect the database server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks,” advised ASEC.
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
