A security expert at Kaspersky, Yanis Zinchenko has spoken on the modalities of the recently discovered ramsomeware, Yanluowang, saying though the malware has only been around for a short period, Yanluowang has managed to target companies from all around the world.
He explained that the Yanluowang ransomware group breached the corporate networks of large organisations and extort them under the threat of leaking stolen files online, with victims across the U.S., Brazil, Germany, UAE, China, Turkey and many other countries.
“This is not the first case of Yanluowang’s impudent attacks we have observed throughout the year. Yanluowang is a relatively new ransomware, which unknown attackers use to target large companies. It was first reported late last year. Although the malware has only been around for a short period, Yanluowang has managed to target companies from all around the world,” he said.
While the gang announced the Cisco breach on their data leak site, the company claims it found no evidence of ransomware payloads during the attack. This behaviour is typical for many ransomware operators as they try to seize every opportunity to extort money and harm their victims’ reputations.
He advised corporate organisations not to encourage ransomware players by paying their ransom, stressing that it does not guarantee that they will return the data nor will it stop the attack from happening again.
Speaking on what Kaspersky is doing to forestall the incidence of Yanluowang ransomware attack, Yanis Zinchenko said the company is working hard to help companies avoid such outcomes, adding that it is important that businesses follow basic security principles to stay protected and minimise the potential financial and reputational losses associated with a ransomware attack.
“While analysing the Yanluowang malware in April, we discovered that the malicious code was not perfect. The vulnerability discovered in the code allowed us to create a file decryptor with the help of a known-plaintext attack. Our Rannoh Decryptor can analyse encrypted files and helps victims of Yanluowang ransomware recover their information,” he said.
