The Week in Ransomware - September 15th 2023 - Russian Roulette

This week’s big news is the extortion attacks on the Caesars and MGM Las Vegas casino chains, with one having already paid the ransom and the other still facing operational disruptions.

Caesers was first quietly breached earlier this month, with the attackers stealing its loyalty program database. This database contains driver's license numbers and social security for customers, and to prevent the leak of the data, Caesers paid a ransom demand.

According to a report by the Wall Street Journal, the threat actors demanded $30 million not to leak the data, but the Casino negotiated it down to a $15 million payment.

"We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result," Caesars said in an SEC 8-K filing published after news of the attack leaked.

This week, MGM Resorts suffered a ransomware attack, causing massive disruptions in its casinos, such as ATMs and credit card machines not working, guests locked our of hotel rooms, and slot machines not working.

It was later confirmed that this attack was conducted by an affiliate for the BlackCat/ALPHV ransomware operation known as Scattered Spider.

In a lengthy statement on the ransomware gang's data leak site, the threat actors claim to have gained full access to the company's network and ultimately encrypted 100 VMware ESXi servers.

We also learned about ransomware attacks on the United Kingdom's Greater Manchester Police (GMP), the Auckland transport authority, and IT solutions provider ORBCOMM.

Finally, some interesting research was released this week:

• Report on how a ransomware initial access broker is stealing credentials through Microsoft Teams phishing.
• Research on a new 3AM ransomware operation, which has been seen deployed by a LockBit affiliate.
• An analysis of the Money Message ransomware encryptor.

Contributors and those who provided new ransomware information and stories this week include: @Seifreed, @malwareforme, @serghei, @malwrhunterteam, @BleepinComputer, @demonslay335, @Ionut_Ilascu, @LawrenceAbrams, @billtoulas, @vxunderground, @BroadcomSW, @MsftSecIntel, @AlvieriD, @WilliamTurton, @GeeksCyber, @pcrisk, and @Mandiant.

September 11th 2023

MGM Resorts shuts down IT systems after cyberattack

MGM Resorts International disclosed today that it is dealing with a cybersecurity issue that impacted some of its systems, including its main website, online reservations, and in-casino services, like ATMs, slot machines, and credit card machines.

New STOP ransomware variants

PCrisk found new STOP ransomware variants that append the .hgfu and .hgew extensions.

September 12th 2023

Ransomware access broker steals accounts via Microsoft Teams phishing

Microsoft says an initial access broker known for working with ransomware groups has recently switched to Microsoft Teams phishing attacks to breach corporate networks.

New AnonTsugumi ransomware

PCrisk found a ransomware called AnonTsugumi that appends the .anontsugumi extension and drops a ransom note named README.txt.

September 13th 2023

Hackers use new 3AM ransomware to save failed LockBit attack

A new ransomware strain called 3AM has been uncovered after a threat actor used it in an attack that failed to deploy LockBit ransomware on a target network.

New STOP ransomware variants

PCrisk found new STOP ransomware variants that append the .ooza and .oopl extensions.

September 14th 2023

Manchester Police officers' data exposed in ransomware attack

United Kingdom's Greater Manchester Police (GMP) said earlier today that some of its employees' personal information was impacted by a ransomware attack that hit a third-party supplier.

Caesars Entertainment confirms ransom payment, customer data theft

Caesars Entertainment, self-described as the largest U.S. casino chain with the most extensive loyalty program in the industry, says it paid a ransom to avoid the online leak of customer data stolen in a recent cyberattack.

Auckland transport authority hit by suspected ransomware attack

The Auckland Transport (AT) transportation authority in New Zealand is dealing with a widespread outage caused by a cyber incident, impacting a wide range of customer services.

MGM casino's ESXi servers allegedly encrypted in ransomware attack

An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts’ operations, forcing the company to shut down IT systems.

Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety

UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors appear to operate in underground communities, such as Telegram and underground forums, which they may leverage to acquire tools, services, and/or other support to augment their operations.

September 15th 2023

ORBCOMM ransomware attack causes trucking fleet management outage

Trucking and fleet management solutions provider ORBCOMM has confirmed that a ransomware attack is behind recent service outages preventing trucking companies from managing their fleets.

A detailed analysis of the Money Message Ransomware

The threat actor group, Money Message ransomware, first appeared in March 2023, demanding million-dollar ransoms from its targets. Its configuration, which contains the services and processes to stop a ransomware attack, can be found at the end of the executable. The ransomware creates a mutex and deletes the Volume Shadow Copies using vssadmin.exe.

New Elibe ransomware

PCrisk found a ransomware variant that appends the .elibe extension and drops a ranom note named FILES ENCRYPTED.txt.

New STOP ransomware variant

PCrisk found a STOP ransomware variant that appends the .oohu extension.

That's it for this week! Hope everyone has a nice weekend!

Source