Facebook Twitter LinkedIn RSS
    Trending
    • Unbeatable Discounts on L’Oréal’s Dermatological Beauty Brands
    • First Asset Management launches N100 billion infrastructure fund
    • From Lagos to Nairobi: How One African Crypto Community Transformed a Bitcoin Milestone into a Continental Movement
    • NITDA: 56% of IT projects fail due to tech obsession, poor planning
    • Sanwo-Olu, Sule, and Other Visionaries to Headline Lagos Future Conference 2025
    • Zoho Launches Ulaa Enterprise, a Secure and User-Friendly Browser for Modern Workplaces
    • Self-optimising AI: The New Frontier of Technological Innovation, By Louis Napoletani
    • Mart Networks Launches Invinsense-Powered Cybersecurity Solution Tailored for Fintechs
    Facebook Twitter LinkedIn
    ITPulse.com.ngITPulse.com.ng
    • News
    • Interviews
    • Blogs
    • Analysis
    • Opinion
    • Videos
    • Press Releases
    • Pictures
    • Advertise
    ITPulse.com.ngITPulse.com.ng
    Home»News»Be wary of DearCry ransomware, Sophos warns unsuspecting Internet users
    News 3 Mins Read

    Be wary of DearCry ransomware, Sophos warns unsuspecting Internet users

    mmBy ITPulseMarch 16, 2021
    Facebook Twitter WhatsApp Pinterest LinkedIn Reddit Tumblr Email
    NITDA, Risk accessment solution, Cyber Security
    Share
    Facebook Twitter LinkedIn Pinterest Email

    Cybersecurity researchers at Sophos have warned that there is a need to identify other adversaries beyond Hafnium that are exploiting bugs to launch attacks, following the reporting of the Microsoft Exchange vulnerabilities and the out-of-band release of security patches earlier this month.

    One of such adversaries, which cybercriminals are now using to launch attacks is the discovery of DearCry ransomware, where in an article Sophos noted that DearCry ransomware: “DearCry attacks exploit Exchange server vulnerabilities,”.

    The article outlines some new and interesting discoveries about its encryption behavior and more. According to the article headlined by Mark Loman, a ransomware expert at Sophos and director, engineering technology office, the recently-patched set of vulnerabilities in on-premises versions of Microsoft Exchange Server has been actively exploited for over two months.

    He said, the exploit initially attributed to a Chinese state-sponsored actor, has now been adopted for a range of cybercrime activities—the latest being ransomware called DearCry.

    “Our analysis of DearCry ransomware samples has uncovered a rare encryption attack behavior: a ‘hybrid’ approach. The only other ransomware I’ve investigated over the years that employed a hybrid approach was WannaCry, and this was auto spreading rather than human-operated like DearCry. Both first create an encrypted copy of the attached file, an approach we call ‘copy’ encryption, and then overwrite the original file to prevent recovery, what we call ‘in-place’ encryption. ‘Copy’ ransomware allows victims to potentially recover some data. However, with ‘in-place’ encryption, recovery via undelete tools is impossible. Notorious human-operated ransomware like Ryuk, REvil, BitPaymer, Maze and Clop, use ‘in-place’ encryption only,” he said.

    He explained that there are a number of other similarities between DearCry and WannaCry, including the names and the header added to encrypted files. These do not automatically link DearCry to WannaCry’s creator. DearCry’s code, approach and abilities differ significantly from WannaCry; it does not use a command-and-control server, has an embedded RSA encryption key, shows no user interface with a timer and – most importantly – does not spread itself to other machines on the network.

    Hear him: “We found a number of other unusual DearCry characteristics, including the fact that the ransomware actor has been creating new binaries for new victims. The list of file types targeted has evolved from victim-to-victim too. Our analysis further shows that the code does not come with the kind of anti-detection features you would normally expect with ransomware, like packing or obfuscation. These and other signs suggest that DearCry may be a prototype, possibly rushed into use to seize the opportunity presented by the Microsoft Exchange Server vulnerabilities, or created by less experienced developers.

    “Defenders should take urgent steps to install Microsoft’s patches to prevent exploitation of their Exchange Server. If this is not possible, the server should be disconnected from the internet or closely monitored by a threat response team”.

    The DearCry ransomware, according to the article appears to be created by a beginner, stressing that it is unsophisticated, and does little to hide itself from detection. Its most notable feature is that the encryption header that DearCry adds to the attacked files looks similar to the header used by the notorious WannaCry ransomware, which seems more than a coincidence.

    DearCry ransomware WannaCry
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email
    mm
    ITPulse
    • Website
    • Facebook
    • Twitter
    • LinkedIn

    ITPulse is a wholly information technology communication (ICT) news website, with a special focus on the African continent. The website provides up-to-date biz-tech news, analysis and comprehensive and thorough insight into the continent's ICT terrain

    Related Posts

    Unbeatable Discounts on L’Oréal’s Dermatological Beauty Brands

    May 21, 2025

    First Asset Management launches N100 billion infrastructure fund

    May 21, 2025

    NITDA: 56% of IT projects fail due to tech obsession, poor planning

    May 20, 2025

    Leave A Reply Cancel Reply

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Latest Posts

    Unbeatable Discounts on L’Oréal’s Dermatological Beauty Brands

    May 21, 2025

    First Asset Management launches N100 billion infrastructure fund

    May 21, 2025

    From Lagos to Nairobi: How One African Crypto Community Transformed a Bitcoin Milestone into a Continental Movement

    May 21, 2025
    About
    About

    Itpulse.com.ng is a wholly information technology communication (ICT) news website, with special focus on the African continent. The website provides up-to-date biz-tech news, analysis and a comprehensive and thorough insight info the continent's ICT terrain.

    Contact us: editorial@itpulse.com.ng

    Facebook Twitter LinkedIn RSS
    Latest Posts

    Unbeatable Discounts on L’Oréal’s Dermatological Beauty Brands

    May 21, 2025

    First Asset Management launches N100 billion infrastructure fund

    May 21, 2025

    From Lagos to Nairobi: How One African Crypto Community Transformed a Bitcoin Milestone into a Continental Movement

    May 21, 2025
    Popular Posts

    Beyond SIEM: Designing Adaptive Threat Response Systems Using Context-Aware Correlation Models

    September 22, 2023

    Writing Code for Future Strangers: Engineering for unknown teams, contexts, and missions

    March 5, 2023

    Sanwo-Olu, Sule, and Other Visionaries to Headline Lagos Future Conference 2025

    May 20, 2025
    © 2017 - 2025 Itpulse. Designed by Max Excellence.
    • Terms & Conditions
    • Privacy Policy
    • Advertise
    • Contact Us

    Type above and press Enter to search. Press Esc to cancel.