Microsoft SQL servers are succumbing to FARGO ransomware, security researchers at AhnLab Security Emergency Response Center (ASEC) have warned.
Alongside GlobeImposter, FARGO has become one of the most widespread ransomware that targets vulnerable MS-SQL servers, the company stated in a blog post. Statistical data from “ID Ransomware” attests to the burgeoning growth.
RELATED RESOURCE
How to reduce the risk of phishing and ransomware
Top security concerns and tips for mitigation
The strain was previously codenamed “Mallox” after analysts discerned the ransomware added a “.mallox” extension to encrypted files. Avast detailed the same strain in a report in February, labelling the ransomware “TargetCompany”.
Additionally, the cyber security firm released a decryption utility to help TargetCompany ransomware victims recover their files for free. However, the decryptor could only restore encrypted files under limited circumstances.
Decoding active exploits by FARGO ransomware, ASEC stated the strain causes a compromised machine to download a .NET file using cmd.exe and powershell.exe.
“The loaded malware generates and executes a BAT file which shuts down certain processes and services, in the %temp% directory,” added the company.
After injecting itself into AppLaunch.exe, the ransomware payload attempts to delete the registry key for the open-source ransomware vaccine Raccine. But that’s not all. The malware deactivates database processes and executes a recovery deactivation command to unencrypt confidential data.
“Administrators of MS-SQL servers should use passwords that are difficult to guess for their accounts and change them periodically to protect the database server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks,” advised ASEC.
-
Enterprise networking - but without the therapy billsIndustry insights Historically the networking channel has been on focused on features, but we now need to shift emphasis to enablement...
-
Why is Meta still funding the metaverse?Analysis VR hype seemed to evaporate as fast as it arrived. Has the money Meta has sunk into it folly, or part of a larger strategy that's yet to bear fruit?
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
