{"id":1586,"date":"2025-01-16T08:16:02","date_gmt":"2025-01-16T08:16:02","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/16\/python-based-malware-powers-ransomhub-ransomware-attacks\/"},"modified":"2025-01-16T08:16:03","modified_gmt":"2025-01-16T08:16:03","slug":"python-based-malware-powers-ransomhub-ransomware-attacks","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/python-based-malware-powers-ransomhub-ransomware-attacks\/","title":{"rendered":"Python-Based Malware Powers RansomHub Ransomware Attacks"},"content":{"rendered":"\n<\/p>\n

Ransomware Attack Involves Python-Based Backdoor and RansomHub Ransomware<\/strong><\/p>\n

By Ravie Lakshmanan, January 16, 2025<\/strong><\/p>\n

<\/a><\/div>\n

Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to maintain persistent access to compromised endpoints and then leveraged this access to deploy the RansomHub ransomware throughout the target network.<\/p>\n

Initial Access Facilitated by JavaScript Malware<\/strong><\/p>\n

According to GuidePoint Security, initial access is said to have been facilitated by means of a JavaScript malware downloaded named SOCgholish malware, which exploits the Boinc mining protocol.<\/p>\n

"Threat actor Codefinger abuses publicly disclosed AWS keys with permissions to write and read S3 objects," Halcyon said. "By utilizing AWS native services, they achieve encryption in a way that is both secure and unrecoverable without their cooperation."<\/p>\n

Rapid-Fire Phishing Campaigns Mimicking Black Basta Ransomware Crew<\/strong><\/p>\n

The development comes as SlashNext said it has witnessed a surge in "rapid-fire" phishing campaigns mimicking the Black Basta ransomware crew’s email bombing technique to flood victims’ inboxes with over 1,100 legitimate messages related to newsletters or payment notices.<\/p>\n

"Then, when people feel overwhelmed, the attackers swoop in via phone calls or Microsoft Teams messages, posing as company tech support with a simple fix," the company said.<\/p>\n

"They speak with confidence to gain trust, directing users to install remote-access software like TeamViewer or AnyDesk. Once that software is on a device, attackers slip in quietly. From there, they can spread harmful programs or sneak into other areas of the network, clearing a path straight to sensitive data."<\/p>\n

Follow The Hacker News on Twitter and LinkedIn<\/strong><\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i> and LinkedIn to read more exclusive content we post.<\/p>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Ransomware Attack Involves Python-Based Backdoor and RansomHub Ransomware By Ravie Lakshmanan, January 16, 2025 Cybersecurity researchers have detailed an attack that involved a threat actor utilizing a Python-based backdoor to…<\/p>\n","protected":false},"author":19,"featured_media":1587,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-1586","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/01\/1737015362_ransomware.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=1586"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1586\/revisions"}],"predecessor-version":[{"id":1588,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1586\/revisions\/1588"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/1587"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=1586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=1586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=1586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}