Lead: Hacker Organization: Nothing can stop me from making money!
The British epidemic is out of control, but hackers are taking the opportunity to blackmail money.
According to BBC reports, hackers recently stole data from Hospital Group, a large cosmetic surgery chain in the UK, and threatened to publish photos and other details of patients before and after surgery.
The hacker organization REvil stated on its dark web page that customer photos are not entirely pleasant sights. It claims to have obtained more than 900G of patient photos.
The plastic surgery hospital has confirmed the attack and said:
We can confirm that our information technology system is affected by a data security breach. None of our patients’ payment card details have been leaked, but at this stage, we understand that some of our patients’ personal data may have been accessed. We have reminded all patients of this event and will provide them with regular updates as the situation becomes clearer. We have secured our system and are conducting a full investigation to understand the extent of the incident. We are working with the National Cyber Security Center, the Office of the Information Commissioner, cyber security experts and the police to resolve this issue as quickly as possible.
What is the origin of the attacked Hospital Group?
The Hospital Group-also known as Transform Hospital Group-claims to be the leader in weight loss and cosmetic surgery in the UK.
According to its homepage, it has 11 clinics specializing in bariatric surgery, breast augmentation, nipple correction and nose adjustment.
Many celebrities are their customers.
For example, former Big Brother player Aisleyne Horgan-Wallace revealed to Zoo Magazine in 2009 that she had breast augmentation surgery at Hospital Group; Atomic Kitten singer Kerry Katona; "Shameless" actress Tina Malone and reality show "The Only Way is" "Essex" star Joey Essex was also a patient of the clinic.
Although the plastic surgery hospital mentioned in the statement that the hacker has not leaked the patient's payment details, the hacker has already obtained some personal data, which contains a lot of content.
Such as the patient’s name, ID number, date of birth and sensitive information about their diagnosis, and even their social security ID.
In other words, although the hackers did not clearly state how much money they want to blackmail, in fact, they are fancying a bigger deal.
This means that hackers are not only targeting the hospital, but also customers (after all, it is not a small amount to do plastic surgery).
Especially this ransomware is not easy to mess with.
REvil (Sodinokibi) is not easy to mess with
Yes, it was REvil (Sodinokibi) who attacked this plastic surgery hospital.
In today's many ransomware fields, REvil (Sodinokibi) ransomware occupies a dominant position.
REvil (Sodinokibi) operates in the form of ransomware as a service (RaaS), renting out its ransomware viruses to other criminal groups.
These organizations, called REvil Affaliates, are only responsible for distributing ransomware to victims through their own channels, and then demand a ransom based on the number of computers infected on the target corporate network.
The REvil ransomware operator, also known as Sodinokibi, has a "long and glorious" attack history. In addition to locking the system, the team also runs a double-strike system, whereby they steal data before encrypting it and use this as a means to facilitate ransom payment.
Generally speaking, after the ransomware finds a breakthrough in the corporate network, it first uses scanning and blasting to obtain the authority of a weaker host in the intranet, and then uploads a hacker toolkit to scan and blast the intranet or capture the password. Choosing important servers and PCs for encryption, and then trying to move content horizontally, encrypting as many hosts or servers as possible in the entire corporate intranet, it can be said that one unit is lost and the entire network suffers.
The great thing about the ransomware is that they are gangs working together to make money.
The general operation steps are as follows:
After the Sodinokibi ransomware runs successfully, it will leave the following ransom information on the host, which is a document in the form of "random suffix-readme.txt":
In order to make it easier for you to find him and pay, they also "intimately" leave clues for you...
One is a dark web chat page and the other is a normal chat page. The victim company can contact (visit) one of the links according to its own situation. After visiting the link, you can chat through the web page. The design is very professional, and the hacker can negotiate with the victim company on the ransom.
Of course, if you do not accept the terms, they still have a 24-hour online negotiation expert.
The asking price of Sodinokibi ransomware is generally high, mostly in the range of 3 to 6 bitcoins. Therefore, its main targets are enterprises, and medium and large enterprises. The purpose of its attack is to paralyze the core business network of the enterprise. Therefore, many victimized enterprises are forced to Reluctantly paid a lot of ransom.
And because it is an industrialized operation, each participant has a corresponding share. When the victim company transfers bitcoins to the hacker's wallet, the wallet will be transferred to other members' wallets in batches.
The bulk of the ransom from each attack is allocated to the attacker and the organization operator by the coordinating wallet, so the contribution after a single success is relatively large, and any individual or team can participate in the attack activities of different customers, similar to sales The team, every time a single is made, the mention of Chengdu is quite impressive. The final big head is of course given to the organization operator, who is responsible for pulling all links and resources to ensure the normal operation of the platform and the gang.
Moreover, this kind of blackmail attack is extremely difficult to crack, and companies or individuals can only pay the ransom obediently.
In May of this year, hackers from the REvil ransomware organization stole top celebrity data from a New York law firm called Grubman Shire Meiselas & Sacks.
They claimed that if they did not pay them a ransom of $42 million, they would release more destructive material. They have "tons of dirty material" about Trump, and once Trump is released, they don't want to be president again.
In addition to Trump, entertainment superstars such as Lady Gaga, Madonna, U2, and Nicky Mina are also victims.
Compare the target of this attack, so you know the consequences.
A few safety recommendations
Although this is a common topic, the editor of Leifeng.com still has to say, don't go to websites that shouldn't be, don't click links that shouldn't, and don't post things that shouldn't be.
Regarding the ransomware, Leifeng.com also found several old security drivers to advise everyone. In general, for companies and individuals, the following six aspects of defense work must be done:
Non-local backup of important data;
Turn on the firewall and install anti-virus software;
Beware of unknown emails and do not click on unknown emails and attachments;
Close unnecessary ports, such as 445, 135, 139, 3389, etc.;
Try not to use LAN sharing;
Patch vulnerabilities in service components such as Weblogic and Apache Struts2 in time.
Reference materials:
【1】https://www.bbc.co.uk/news/technology-55439190
【2】https://www.databreaches.net/uk-transform-hospital-group-falls-prey-to-ransomware-attack/
Posts
