Displaying items by tag: Mark Loman

Some of the most prolific and active ransomware groups are deliberately switching on remote encryption for their attacks, global cyber security as a service firm Sophos has warned.

Close on the heels of the DearCry Windows ransomware, that appeared earlier this month and attacked Microsoft Exchange Server flaws, another strain, known as Black Kingdom, has emerged to take advantage of the same vulnerabilities.

Global security vendor Sophos claims to have developed a means of blocking malicious software, that is evading detection by loading fileless executables into temporary memory, from running.

The new kid on the Windows ransomware block, WastedLocker, may be causing foreheads to wrinkle over at companies that fear attacks from this genre of malware, but it has given security firms, like global operator Sophos and Russian company Kaspersky, plenty of meat for its researchers to sink their teeth into.

Security firm Sophos says it has found Windows ransomware using a virtual machine on a victim's machine to attack that same machine, with a 49kb ransomware executable generated from an attack payload of 122MB with a 282MB virtual image inside.