New “Yanluowang” Ransomware Variant Discovered

Security researchers are warning of a newly learned ransomware variant now currently being used in focused attacks.

Dubbed “Yanluowang” right after the .yanluowang extension it adds to encrypted documents, the new ransomware was identified by Symantec during its investigation into an attack from an unnamed “large group.”

It appears that the group applying the variant to start with deployed legitimate command-line Energetic Listing query software AdFind for reconnaissance and to help with lateral movement.

Just before Yanluowang is downloaded, an further software generates a .txt file with the selection of remote devices to check in the command line and works by using WMI to get a record of processes managing on these equipment.

It also logs all the procedures and remote device names, Symantec stated.

Then, following deployment, the malware stops all hypervisor devices working on the targeted equipment, finishes the procedures stated in the .txt file, encrypts the files and drops a ransom be aware named README.txt.

The be aware purpotedly warns victims not to make contact with the police or any specialized ransomware negotiation firms.

“If the attackers’ rules are damaged the ransomware operators say they will conduct distributed denial of assistance (DDoS) assaults in opposition to the sufferer, as nicely as make ‘calls to workers and enterprise companions.’ The criminals also threaten to repeat the attack ‘in a several weeks’ and delete the victim’s data,” Symantec revealed in a blog put up.

“While the Yanluowang ransomware appears to be nevertheless under advancement it need to by no implies be underestimated. Qualified ransomware is just one of the largest cyber-threats confronted by companies right now and, as such, all new ransomware threats need to be taken equally severely.”

The quantity of ransomware attacks surged by 288% in between the first and next quarters of 2021, according to the most recent info from the NCC Group.

Yanluowang refers to a Chinese deity connected to the underworld, despite the fact that Symantec had no affirmation about the origin of the danger group.

Some parts of this article are sourced from:
www.infosecurity-journal.com