Trickbot levels up Again

When journalists and researchers talk about the information-stealing trojan Trickbot a number of superlatives are used to describe how successful the malware has become. In many cases, Trickbot has earned those superlatives as it is one of the most notorious pieces of malware currently making up the threat landscape. Three recent events in the malware life cycle prove this viewpoint. Early in 2019, Trickbot partnered with the equally notorious ransomware Ryuk in order to share resources and victims. The event showed that the operators behind Trickbot are willing to partner up for the good of turning even more profit. Then in the last quarter of 2019, the malware was upgraded to include a module that allowed for SIM swapping attacks. Then in March of this year Ryuk, with the help of Trickbot, added the Fortune 500 Company EMCOR to the ransomware ever-increasing victim list. Now Trickbot again makes headlines as...

Bomba Ransomware

Bomba is a piece of malicious software, belonging to the Scarab ransomware family. Systems infected with this malware have their data encrypted and receive payment demands for the decryption tools/software. During the encryption process, all affected flies are appended with the ".bomba" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.bomba" - following encryption. Once this process is finished, a ransom note - "HOW TO RECOVER ENCRYPTED FILES.TXT" is dropped into every compromised folder. Additionally, Bomba ransomware disables Windows Task Manager. The ransom note ("HOW TO RECOVER ENCRYPTED FILES.TXT") informs victims that their data has been encrypted. According to this message, the only way of recovering the files is by purchasing the decryption tools from cyber criminals behind the infection. The note also contains contact details of the criminals - Telegram...