Emotet Raised from the Dead

Widely regarded as one of the most dangerous botnets in recent history Emotet activity stopped in May 2019. Researchers noticed that Emotet activity started picking up again in August. In less than a month, researchers have detected a new spam email campaign been distributed by the botnet. Malicious emails have been sent from the Emotet botnet have been seen spotted targeting those residing in Germany, the United Kingdom, Poland, and Italy. Further, emails have been seen sent to US individuals, businesses, and government organizations. By June 2019 all activity on Emotet servers had ceased. On August 22, 2019, the command and control servers starting receiving requests and acting upon those requests. Researchers noticed that those behind the botnet have been actively preparing for a new spam email campaign. This preparation involved cleaning it of fake bots, putting together new campaigns, and establishing th...

StuardRitchi Ransomware

StuardRitchi is a ransomware, belonging to the GlobeImposter ransomware family. It is designed to encrypt files and keep them on lock-down, until a ransom is paid (decryption software/tool is bought). StuardRitchi changes afflicted file extensions into ".crypt", which would make "1.jpg" appear as "1.jpg.crypt" and so on. It drops an html file, titled "how_to_back_files.html" on victim's desktop, which contains the ransom demanding message. This malicious piece of software was discovered by dnwls0719. The ransom note states, that to recover their encrypted files, users need to purchase a decryptor. To buy the decryption software/tool victims are told to contact the cyber criminal via email addresses provided. The message further tells the price of (ransom demanded for) the offered decryptor to be 2,500 US dollars in Bitcoin cryptocurrency. Cryptocurrency, pre-paid vouchers and other digital currencies are d...