briefly.co Open in urlscan Pro
54.237.159.171  Public Scan

Form analysis
0 forms found in the DOM

Text Content

TodayBrowse

Sign upLog in
Click any sentence to highlight it.
Sign up / Log in to save.


Welcome to Briefly
your tl;dr for the Internet

You can use Briefly to save content for yourself and to share across your social
networks, including Twitter and LinkedIn. Your highlights contribute to
organized feeds, curated by real people like you who care about the same topics.

Together we can build a better newsfeed!

More about Briefly.

Welcome to Briefly
your tl;dr for the Internet. About Briefly

Highlight and share articles

Build a better feed for yourself and others

Securityweek
Yanluowang Ransomware Targeting U.S. Financial Corporations | SecurityWeek.Com


Problem with this article? Report
Initially detailed in October, Yanluowang has been used in a series of targeted
attacks against large organizations, despite being a new, seemingly undeveloped
piece of malware.
As part of the attacks, the adversary also employed AdFind for reconnaissance.
According to Symantec, the Yanluowang ransomware "is now being used by a threat
actor that has been mounting targeted attacks against U.S. corporations since at
least August 2021."
The financial sector appears to be the main target, but the hackers have also
targeted manufacturing, IT services, consultancy, and engineering companies.
Tools, tactics, and procedures (TTPs) employed by the adversary appear similar
to those used by Thieflock ransomware operators, suggesting the threat actor
might have switched to a new malware family.
Thieflock is a ransomware-as-a-service (RaaS) developed by the FiveHands group,
and Symantec believes that a former Thieflock affiliate might be operating
Yanluowang now.
The assumption is based on the use of custom password recovery tools, of
open-source network scanning tools, and of free browsers in attacks.
However the two ransomware families do not appear to be sharing authorship,
Symantec says.
As part of the recently observed Yanluowang attacks, PowerShell is employed for
the download of various payloads onto the compromised machines, and RDP is
enabled in the registry for remote access to the compromised machine.
The ConnectWise remote access tool is also being deployed.
The attackers employ AdFind to query Active Directory and identify systems of
interest for lateral movement.
SoftPerfect Network Scanner is also used, along with various credential-stealing
tools, including GrabFF, GrabChrome, BrowserPassView, and KeeThief.
Symantec also identified the use of screen capture and file exfiltration tools,
the presence of a Cobalt Strike Beacon on the systems of one organization, and
the use of tools such as ProxifierPE.
Previous Columns by Ionut Arghire:
Continue
Continue
More in Privacy professionals
 * Amazon's Dark Secret: It Has Failed to Protect Your Data
 * Indonesian Court Allows Internet Blocking During Unrest, Tightening Law
   Enforcement Control Over Users' Communications and Data
 * Facebook and Instagram gathering browsing data from under-18s, study says
 * Someone Snuck a Card Skimmer Into Costco to Steal Shopper Data
 * The Australian Government Has Declared a War on Trolls
 * Planned Parenthood Says Hacker Compromised Information for 400,000 Patients
 * Los Angeles Planned Parenthood Hack Breaches the Medical Data of 400,000
   Patients
 * Social media giants monetise anger and trolling is the result. A crackdown is
   welcome | Peter Lewis
 * New Ransomware Variant Could Become Next Big Threat
 * Are you lazy with iPhone or Gmail security? Quarter of adults 'victim of
   hackers'

Invite
AboutPrivacyTerms of UseSupportBlogFor content owners
PrivacyLegalSupportFor content owners
…
Cookie Control Close Icon


THIS SITE USES COOKIES TO STORE INFORMATION ON YOUR COMPUTER.

Some of these cookies are essential, while others help us to improve your
experience by providing insights into how the site is being used.

I AcceptI Do Not Accept

--------------------------------------------------------------------------------


NECESSARY COOKIES

Necessary cookies enable core functionality such as page navigation and access
to secure areas. The website cannot function properly without these cookies, and
can only be disabled by changing your browser preferences.

--------------------------------------------------------------------------------


ANALYTICAL COOKIES

Analytical cookies help us to improve our website by collecting and reporting
information on its usage.

Show vendors within this category
Analytical CookiesOnOff

--------------------------------------------------------------------------------

About this tool(Opens in a new window)External Link Icon
Cookie Control