Jump to content
Riadg

attacked with an MBED

Recommended Posts

I am attacked with an MBED ransom ware which is now asking me to make payment of a lot of $. Please do help me I have lot of company data in and also note already was have latest updated modules and definitions for out ESET products 
,So need help because we discover this case only in 3 computers Otherwise there is more than 200 computer on the same range .we have to find solution to fix this as soon as possible 

 

Share this post


Link to post
Share on other sites

It's Filecoder.STOP. Only certain variants can be decrypted and only if the machine was offline when the encryption occurred.

Please get the following stuff and send it to samples[at]eset.com:
- a handful of encrypted files (ideally Office documents)
- the ransomware note with payment info
- logs collected with ESET Log Collector.

Share this post


Link to post
Share on other sites

This recent article related to this specific STOP ransomware variant might be informative: https://malwaretips.com/blogs/remove-mbed/

Of note:

Quote

 

2. How did the Mbed ransomware get on my computer?

The Mbed ransomware is distributed via spam email containing infected attachments or by exploiting vulnerabilities in the operating system and installed programs.

Cyber-criminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx. The email tells you that they tried to deliver a package to you, but failed for some reason. Sometimes the emails claim to be notifications of a shipment you have made. Either way, you can’t resist being curious as to what the email is referring to – and open the attached file (or click on a link embedded inside the email). And with that, your computer is infected with the Mbed ransomware.

This ransomware was also observed attacking victims by hacking open Remote Desktop Services (RDP) ports. The attackers scan for the systems running RDP and then attempt to brute force the password for the systems

 

 

 

 

Edited by itman

Share this post


Link to post
Share on other sites

I will also add that there is a locked screen RDP bypass vulnerability affecting Win 10 1803+ versions plus Server 2019 that has never been patched as far as I am aware of. You can read what this vulnerability is and recommended mitigations for it here: https://www.kb.cert.org/vuls/id/576688/

Edited by itman

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...