By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    A Malware Classification -Kaspersky Daily
    12 months ago
    Superfish: adware preinstalled on Lenovo laptops
    12 months ago
    Russian-speaking cyber spies from Turla APT group exploit satellites
    12 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    5 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    6 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    7 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Surface Pro released and the 128 GB version already sold out at the online Microsoft Store [Updated]
    12 months ago
    Windows 11 build 22622.590 (KB5017846) outs in the Beta Channel
    12 months ago
    How to protect computer from virus and hackers on Windows 11
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    17 hours ago
    Cloudflare account permissions, how to use them, and best practices
    Cloudflare account permissions, how to use them, and best practices
    17 hours ago
    Announcing Cloudflare Incident Alerts
    Announcing Cloudflare Incident Alerts
    17 hours ago
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    2 days ago
    A new wave of innovation with Edge, your AI-powered browser
    3 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to match Windows 11 accent color on Google Chrome
    2 weeks ago
    Gmail AI feature Auto-complete
    12 months ago
    Windows 11 build 22623.746 (KB5018490) rolls out in the Beta Channel
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    6 days ago
    How to disable Copilot on Windows 11 (completely)
    2 weeks ago
    How to blur image background in Photos for Windows 11
    2 weeks ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    2 weeks ago
  • Glossary
  • My Bookmarks
Reading: There is a mass mailing of the Troldesh cipher virus on behalf of Russian companies
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
How ToThreats

There is a mass mailing of the Troldesh cipher virus on behalf of Russian companies

Tom Grant
Last updated: 13 October
Tom Grant 12 months ago
Share
4 Min Read

Group-IB experts warn users of increased activity of the Troldesh (Shade) encryption virus. The attackers’ goal is to launch a program on the company’s local network, encrypt files and request a ransom.

During the previous attacks , botnet operators sent letters on behalf of banks and retail companies. Now there is a mass mailing on behalf of employees of major airlines (for example, Polar Airlines), car dealers (Rolf) and from the media (RBC, Novosibirsk-online).

In the second quarter of 2019, Group-IB discovered more than 6,000 phishing emails containing Troldesh. At the moment, the campaign of sending out an extortionist virus is active (in June, about 1,100 phishing emails were registered).

Sample of the first version of the Troldesh cryptographer (Shade), 2015.

In the text of phishing emails, attackers introduce themselves as employees of companies and ask to open the attached file. This is an archive that supposedly contains the details of the order. All return addresses are fake. Distribution is carried out through the leased botnet, which includes not only normal servers, but also infected IoT devices, for example, routers.

Malefactors considerably varied the list of the return addresses. They are increasingly being represented by employees of companies from various industries – retail, oil and gas, construction, aviation, recruitment and media. Mailing on behalf of banks is also used, but in the form of personal letters from top managers.

Troldesh is an old cryptographer, first seen back in 2015. It is also known as Shade, XTBL, Trojan.Encoder.858, Da Vinci and No_more_ransome. Attackers regularly change the packer and successfully bypass anti-virus protection. By the end of 2018, Troldesh entered the top 3 most popular encryption viruses, along with RTM and Pony.

The Troldesh control center is located on the Tor network and constantly changes the domain address, which makes it difficult to block it.

Troldesh is sold and leased at specialized sites on the darknet, in connection with which the virus constantly acquires new functionality and changes the way it spreads. Recent campaigns with Troldesh have shown that now it not only encrypts files, but also mines cryptocurrency and generates traffic to websites to increase traffic and income from online advertising.

On the forums where the victims communicate, they say that there is no way to save the encrypted files, that is, the program is written quite competently from a cryptographic point of view.

Kaspersky Lab distributes the Shade Decryptor decoder for free, but it only helps against the first and second versions of the cryptographer.

Prevention against infection standard:

  • Download programs only from trusted sources;
  • do not open suspicious email attachments;
  • do not follow dubious links;
  • make backup copies of important files that are stored separately.

Shade is not only a cryptographer, there are versions that also scan an infected device, and if it is fixed that it has access to accounting systems, additional malware is installed for remote access, says the head of the research and detection of complex threats Kaspersky Labs »Anton Ivanov.

With this software, attackers make attempts to withdraw money from the account. The expert confirmed that there is no decoder for the latest version of Shade.

source: habr.ccom


Translate this article

TAGGED: Encryption, Malware, Phishing, PoC, Software, Targeted Attack, Threat, Threats, Transport Layer Security, Trojan
Tom Grant October 13, 2022 October 7, 2022
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps 17 hours ago
Cloudflare account permissions, how to use them, and best practices
Cloudflare account permissions, how to use them, and best practices
Apps 17 hours ago
Announcing Cloudflare Incident Alerts
Announcing Cloudflare Incident Alerts
Apps 17 hours ago
Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 2 days ago
A new wave of innovation with Edge, your AI-powered browser
Windows 3 days ago

You Might Also Like

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)

17 hours ago
Cloudflare account permissions, how to use them, and best practices
Apps

Cloudflare account permissions, how to use them, and best practices

17 hours ago
Announcing Cloudflare Incident Alerts
Apps

Announcing Cloudflare Incident Alerts

17 hours ago
Welcome to Birthday Week 2023
Apps

Welcome to Birthday Week 2023

2 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Previous Next
Hot News
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Cloudflare account permissions, how to use them, and best practices
Announcing Cloudflare Incident Alerts
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?