Remote desktop services targeted by devious ransomware By Mobile Malls October 17, 2022 0 364 views Publicly uncovered Distant Desktop providers are being abused to deploy new ransomware onto goal endpoints, researchers are saying. A cybersecurity researcher going by the title linuxct not too long ago reached out to MalwareHunterTeam to try to be taught extra a few ransomware pressure they found known as Venus. The staff later discovered that the ransomware operators had been energetic since mid-August 2022, focusing on victims the world over by getting access to a company community by way of the Home windows Distant Desktop protocol, even when a company makes use of an uncommon port quantity for the service. Hiding behind a firewallThe easiest way to guard towards such assaults, researchers concluded, is to place these providers behind a firewall. What’s extra, Distant Desktop Providers shouldn’t be publicly uncovered, and would ideally be accessible solely by way of a Digital Personal Community (VPN).As for Venus ransomware, the modus operandi is nothing out of the peculiar for this kind of malware. As soon as community mapping, endpoint identification, and different reconnaissance work is finished, the malware will kill 39 processes utilized by database servers and Workplace purposes. Occasion logs and shadow copy volumes would get deleted, Information Execution Prevention would get disabled, and all information could be encrypted to hold the .venus extension. Lastly, the ransomware would create a ransom observe, demanding fee in cryptocurrencies in change for the decryption key. Venus would normally demand fee in bitcoin, and the newest data factors to the group demanding 0.02 BTC, or roughly $380, for the decryption key. The top of the ransom observe holds a base64 encoded blob, which researchers imagine is most probably the encrypted decryption key, and new submissions are being uploaded to ID Ransomware every day,Final 12 months, there was one other ransomware pressure utilizing the identical encrypted file extension, however researchers are usually not certain if it’s the identical ransomware variant or not. Take a look at the very best endpoint safety (opens in new tab) providers roundBy way of: BleepingComputer (opens in new tab)Share this:Click to share on Twitter (Opens in new window)Click to share on Facebook (Opens in new window)MoreClick to print (Opens in new window)Click to email a link to a friend (Opens in new window)Click to share on Reddit (Opens in new window)Click to share on LinkedIn (Opens in new window)Click to share on Tumblr (Opens in new window)Click to share on Pinterest (Opens in new window)Click to share on Pocket (Opens in new window)Click to share on Telegram (Opens in new window)Click to share on WhatsApp (Opens in new window)