Microsoft: Windows KB5006674, KB5006670 updates break printing
Microsoft: Windows web content filtering now generally available
Hive ransomware now encrypts Linux and FreeBSD systems
Police arrest hackers behind over 1,800 ransomware attacks
‘Trojan Source’ attack method can hide bugs into open-source code
Signal now lets you report and block spam messages
Microsoft Defender for Windows is getting a massive overhaul
Canadian province health care system disrupted by cyberattack
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Search Redirect
Remove the Search Redirect
Remove the Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets
FBI: HelloKitty ransomware adds DDoS attacks to extortion tactics
The U.S. Federal Bureau of Investigation (FBI) has sent out a flash alert warning private industry partners that the HelloKitty ransomware gang (aka FiveHands) has added distributed denial-of-service (DDoS) attacks to their arsenal of extortion tactics.
In a Friday notification coordinated with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI said that the ransomware group would take their victims’ official websites down in DDoS attacks if they didn’t comply with the ransom demands.
HelloKitty is also known for stealing sensitive documents from victims’ compromised servers before encrypting them. The exfiltrated files are later used as leverage to pressure the victims into paying the ransom under the threat of leaking the stolen data online on a data leak site.
“In some cases, if the victim does not respond quickly or does not pay the ransom, the threat actors will launch a Distributed Denial of Service (DDoS) attack on the victim company’s public facing website,” the FBI said.
“Hello Kitty/FiveHands actors demand varying ransom payments in Bitcoin (BTC) that appear tailored to each victim, commensurate with their assessed ability to pay it. If no ransom is paid, the threat actors will post victim data to the Babuk site payload.bin) or sell it to a third-party data broker.”
The group’s ransomware operators will use several methods to breach the targets’ networks, including compromised credentials and recently patched security flaws in SonicWall products (e.g., CVE-2021-20016, CVE-2021-20021, CVE-2021-20022, CVE-2021-2002).
HelloKity is a human-operated ransomware operation active since November 2020 and first observed by the FBI in January 2021.
The gang is mainly known for breaching and encrypting the systems of CD Projekt Red in February and claiming to have stolen Cyberpunk 2077, Witcher 3, Gwent, and other games’ source code.
HelloKitty later claimed that someone had purchased the files stolen from CD Projekt Red although it was never confirmed.
Since at least July 2021, the ransomware gang was also observed using a Linux variant that targets VMware’s ESXi virtual machine platform.
They’re just one of the multiple ransomware gangs targeting Linux servers after enterprise targets have migrated to using virtual machines for more efficient use of resources and easier device management.
By targeting their virtual machines, ransomware operators can now encrypt multiple servers simultaneously, with a single command, saving time and effort.
Based on submissions made by their victims on the ID Ransomware platform, HelloKitty significantly increased its activity in July and August, immediately after starting to use the Linux variant in attacks.
The HelloKitty ransomware or its variants have also been used under other names including DeathRansom and Fivehands.
The FBI also shared an extensive collection of indicators of compromise (IOCs) in their alert to help cybersecurity professionals and system admins to guard against attack attempts coordinated by the HelloKitty ransomware gang.
FBI: Ranzy Locker ransomware hit at least 30 US companies this year
FBI, CISA, NSA share defense tips for BlackMatter ransomware attacks
New Yanluowang ransomware used in targeted enterprise attacks
Dutch police send warning letters to DDoS booter customers
Microsoft: Azure customer hit by record DDoS attack in August
Not a member yet? Register Now
Microsoft Defender for Windows is getting a massive overhaul
Microsoft warns of rise in password sprays targeting cloud accounts
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.