Rhysida Ransomware Update
Descripción del ataque
El mes de agosto del 2023, se libero un boletin de ciberseguridad sobre la amenaza RHYSIDA. Dicha amenaza a comprometido a 81 victimas, se encuentra en linea y tiene el puesto 31 segun “Ransom-DB”. (https://www.ransom-db.com/ransomware-groups)
Se desconocen el origen y la identidad de Rhysida, pero algunas pistas sugieren que pueden tener su sede en Rusia o en la Comunidad de Estados Independientes, según el idioma y la zona horaria de sus comunicaciones con las víctimas. Por ejemplo, su software de ransomware contiene fragmentos de código y comentarios en ruso, y sus notas de rescate y su sitio de filtración utilizan palabras y frases en ruso. También evitan atacar a organizaciones en Rusia u otros países exsoviéticos.
La banda Rhysida no sólo ha atacado la Biblioteca Británica, sino que también ha lanzado otros ataques de alto perfil contra instituciones gubernamentales y sanitarias de todo el mundo. Algunas de sus víctimas anteriores incluyen:
- El ejército de Chile: en mayo de 2023, Rhysida pirateó el sitio web y el sistema de correo electrónico del ejército de Chile, cifró sus datos y exigió un rescate de 50 Bitcoin (alrededor de 1,9 millones de dólares). Rhysida también filtró algunos de los datos en su sitio de filtración, incluidos documentos militares e información personal de soldados y oficiales.
- Prospect Medical Holdings : En agosto de 2023, Rhysida atacó al grupo hospitalario estadounidense, cifró sus datos y exigió un rescate. Rhysida también amenazó con filtrar los datos de más de 200.000 pacientes y empleados, incluidos 500.000 números de Seguro Social, documentos corporativos y registros de pacientes. El grupo dijo que vendería los datos por 50 Bitcoin (alrededor de 1,9 millones de dólares) en su sitio de filtración, donde publicó muestras de los datos e inició una subasta.
- Ministerio de Salud de Kuwait: En julio de 2023, Rhysida pirateó el Ministerio de Salud de Kuwait, cifró sus datos y exigió un rescate de 50 bitcoins (alrededor de 1,9 millones de dólares). Rhysida también filtró algunos de los datos en su sitio de filtración, incluidos registros médicos e información personal de pacientes y personal.
Recomendaciones
Los actores de Rhysida son conocidos por utilizar correos electrónicos de phishing, software VPN y la vulnerabilidad ZeroLogon (CVE-2020-1472) como vectores de acceso inicial. Para mantenerse protegido, se recomiendan estos tres pasos:
- Tenga cuidado con los ataques de phishing y los correos electrónicos desconocidos.
- Utilice la autenticación multifactor (MFA) para el acceso VPN.
- Aplique el parche Zerologon lanzado por Microsoft.
| Indicator type | Indicator | Description |
| FileHash-MD5 | 009ac2be60f92dc2c41b094ce2d3857c | |
| FileHash-MD5 | 07ed30d2343bf8914daaed872b681118 | MD5 of 1f5b5e40c420f64aa8e8de471367e3decc9763cd |
| FileHash-MD5 | 136f9205a5945681ec470b8461dfee5f | MD5 of 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6 |
| FileHash-MD5 | 14b2f5291036be454ae2fc762ff6eaaa | MD5 of 185c0507011d51d3bf998ea5c4f0618aae52ae41 |
| FileHash-MD5 | 1b9f1a75593dfc670fa7c54659ab5796 | MD5 of c9f0c40e012f8cfe20b1e5cd6a9a7b078e89a00b |
| FileHash-MD5 | 24a648a48741b1ac809e47b9543c6f12 | MD5 of 3e2272b916da4be3c120d17490423230ab62c174 |
| FileHash-MD5 | 2691d7f266050e6849793d4b6661dddf | MD5 of 7f66f109db5f30e17bc4a6705acbcace123c2765 |
| FileHash-MD5 | 2a23848ac28d73352ba80584327ff713 | MD5 of 4e131910e0080799d86aceee036c0e288c0ae6bf |
| FileHash-MD5 | 31e8e12d02a6cac9088d89215cf4552c | MD5 of 587c934f44ec69520d465e13ca7b3b43dd172a41 |
| FileHash-MD5 | 3d4112b92a8285d8661bbc29125bdbf5 | MD5 of 38b53a8767a1c0d7ad774548780e5e071fa0414a |
| FileHash-MD5 | 427214d675b6bce9f273eb2dde0aeefc | MD5 of 423d9b37ef7155c3c36b71ca7f3e6ae154e212e8 |
| FileHash-MD5 | 4f7f8d6c8b22eb5c0c35b29210e2127c | MD5 of b03d70220e185124be9189d979026810d002a6cb |
| FileHash-MD5 | 5801303c49e5bb612aa55fb8b909a9c9 | MD5 of b9cf22418a5c45ede9fb44680fa7f3d90a1e0bee |
| FileHash-MD5 | 657c2da84107644a1397d49e0b526f24 | MD5 of 5c9ea381169e745d68e717cb7ad4adbf6afd6391 |
| FileHash-MD5 | 6c08bae0981841e0cd22ff0f0e8f7510 | MD5 of cad5355c534cccf48ca8df5a1007cc34d37cb619 |
| FileHash-MD5 | 6eeeeb93f86c729faa2280525c699caf | MD5 of 35fca62d65dae3b6c4bfe746f04b5077fb5937d3 |
| FileHash-MD5 | 77bf50713a9eb7b270a73a9797f8ddfe | MD5 of 630ccb6bea18f6224f830216273297ae0bb43718 |
| FileHash-MD5 | 86a1461b30bb482652d8e2223d03c2a4 | |
| FileHash-MD5 | 86a65cfa9f258b0a46ed54e1ad235078 | MD5 of e65d43d47fc1cab8359906711631beba78ab23b5 |
| FileHash-MD5 | 880ed8c97e6bdb64a342fad25094049b | MD5 of 253ba984e247c640fa2c6fe1f93cafdc2d1df573 |
| FileHash-MD5 | 8c24c4084cdc3b7e7f7a88444a012bfc | MD5 of 5ab806618497189342722d42dc382623ac3e1b55 |
| FileHash-MD5 | 93f162d9e1ae290f47695e71589fd4d4 | MD5 of 6e4e76af6078a0272dd1b24822a82058b98a6026 |
| FileHash-MD5 | a0c7585c86ab8bfe6d55a2547e7c9382 | MD5 of c9088174075b01dcd28046441f67f9a7172d113d |
| FileHash-MD5 | ad7e3ddf557e1de0170e384031d3a221 | MD5 of a57cbd620c3dad284b5d88d1cf5fa0d2cd44c4b9 |
| FileHash-MD5 | b5b4abc85d5d8c817ce552c3c6a0aba5 | MD5 of 3f4805854201987dd3d7b834cd5a1958d2cd82f5 |
| FileHash-MD5 | ba9345119c1175c96d27370b0d203e70 | MD5 of aeb2a53e9c8730c2cbd15d620c001d0501e4bb91 |
| FileHash-MD5 | c2b0f2de5955aaa313999ff20b675be4 | MD5 of 15eb06d96700387c1eb7214841cf6a1cb667512d |
| FileHash-MD5 | db89ec570e6281934a5c5fcf7f4c8967 | MD5 of 0098c79e1404b4399bf0e686d88dbf052269a302 |
| FileHash-MD5 | e3ea271e748ccdad6a6d3e692d6f337e | MD5 of f02e06bc439a28aad6dd957df8d0022f22798a09 |
| FileHash-SHA1 | 0098c79e1404b4399bf0e686d88dbf052269a302 | |
| FileHash-SHA1 | 15eb06d96700387c1eb7214841cf6a1cb667512d | |
| FileHash-SHA1 | 185c0507011d51d3bf998ea5c4f0618aae52ae41 | |
| FileHash-SHA1 | 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6 | |
| FileHash-SHA1 | 1f5b5e40c420f64aa8e8de471367e3decc9763cd | |
| FileHash-SHA1 | 253ba984e247c640fa2c6fe1f93cafdc2d1df573 | |
| FileHash-SHA1 | 2fe7a164b987856721fe43eb174090cf69afad54 | |
| FileHash-SHA1 | 35fca62d65dae3b6c4bfe746f04b5077fb5937d3 | |
| FileHash-SHA1 | 38b53a8767a1c0d7ad774548780e5e071fa0414a | |
| FileHash-SHA1 | 3e2272b916da4be3c120d17490423230ab62c174 | |
| FileHash-SHA1 | 3f4805854201987dd3d7b834cd5a1958d2cd82f5 | |
| FileHash-SHA1 | 423d9b37ef7155c3c36b71ca7f3e6ae154e212e8 | |
| FileHash-SHA1 | 4e131910e0080799d86aceee036c0e288c0ae6bf | |
| FileHash-SHA1 | 587c934f44ec69520d465e13ca7b3b43dd172a41 | |
| FileHash-SHA1 | 5ab806618497189342722d42dc382623ac3e1b55 | |
| FileHash-SHA1 | 5c9ea381169e745d68e717cb7ad4adbf6afd6391 | |
| FileHash-SHA1 | 630ccb6bea18f6224f830216273297ae0bb43718 | |
| FileHash-SHA1 | 6e4e76af6078a0272dd1b24822a82058b98a6026 | |
| FileHash-SHA1 | 7f66f109db5f30e17bc4a6705acbcace123c2765 | |
| FileHash-SHA1 | 7f939081b9f2a8f90a9c1ba97391062f4a127895 | |
| FileHash-SHA1 | a57cbd620c3dad284b5d88d1cf5fa0d2cd44c4b9 | |
| FileHash-SHA1 | aeb2a53e9c8730c2cbd15d620c001d0501e4bb91 | |
| FileHash-SHA1 | b03d70220e185124be9189d979026810d002a6cb | |
| FileHash-SHA1 | b9cf22418a5c45ede9fb44680fa7f3d90a1e0bee | |
| FileHash-SHA1 | c9088174075b01dcd28046441f67f9a7172d113d | |
| FileHash-SHA1 | c9f0c40e012f8cfe20b1e5cd6a9a7b078e89a00b | |
| FileHash-SHA1 | cad5355c534cccf48ca8df5a1007cc34d37cb619 | |
| FileHash-SHA1 | e65d43d47fc1cab8359906711631beba78ab23b5 | |
| FileHash-SHA1 | f02e06bc439a28aad6dd957df8d0022f22798a09 | |
| FileHash-SHA256 | 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b | SHA256 of 3e2272b916da4be3c120d17490423230ab62c174 |
| FileHash-SHA256 | 13fd3ad690c73cf0ad26c6716d4e9d1581b47c22fb7518b1d3bf9cfb8f9e9123 | SHA256 of 587c934f44ec69520d465e13ca7b3b43dd172a41 |
| FileHash-SHA256 | 1c4978cd5d750a2985da9b58db137fc74d28422f1e087fd77642faa7efe7b597 | |
| FileHash-SHA256 | 201d8e77ccc2575d910d47042a986480b1da28cf0033e7ee726ad9d45ccf4daa | SHA256 of 15eb06d96700387c1eb7214841cf6a1cb667512d |
| FileHash-SHA256 | 2813b6c07d17d25670163e0f66453b42d2f157bf2e42007806ebc6bb9d114acc | |
| FileHash-SHA256 | 355b4a82313074999bd8fa1332b1ed00034e63bd2a0d0367e2622f35d75cf140 | SHA256 of 6e4e76af6078a0272dd1b24822a82058b98a6026 |
| FileHash-SHA256 | 4226738489c2a67852d51dbf96574f33e44e509bc265b950d495da79bb457400 | SHA256 of 3f4805854201987dd3d7b834cd5a1958d2cd82f5 |
| FileHash-SHA256 | 4243dc8b991f5f8b3c0f233ca2110a1e03a1d716c3f51e88faf1d59b8242d329 | SHA256 of c9088174075b01dcd28046441f67f9a7172d113d |
| FileHash-SHA256 | 48f559e00c472d9ffe3965ab92c6d298f8fb3a3f0d6d203cd2069bfca4bf3a57 | |
| FileHash-SHA256 | 4bf8fbb7db583e1aacbf36c5f740d012c8321f221066cc68107031bd8b6bc1ee | SHA256 of 35fca62d65dae3b6c4bfe746f04b5077fb5937d3 |
| FileHash-SHA256 | 4e34b9442f825a16d7f6557193426ae7a18899ed46d3b896f6e4357367276183 | |
| FileHash-SHA256 | 554f523914cdbaed8b17527170502199c185bd69a41c81102c50dbb0e5e5a78d | SHA256 of 5c9ea381169e745d68e717cb7ad4adbf6afd6391 |
| FileHash-SHA256 | 5e55b4caf47a248a10abd009617684e969dbe5c448d087ee8178262aaab68636 | SHA256 of 185c0507011d51d3bf998ea5c4f0618aae52ae41 |
| FileHash-SHA256 | 5ef168f83b55d2cbd2426afc5e6fa8161270fa6a2a312831332dc472c95dfa42 | SHA256 of b9cf22418a5c45ede9fb44680fa7f3d90a1e0bee |
| FileHash-SHA256 | 6633fa85bb234a75927b23417313e51a4c155e12f71da3959e168851a600b010 | |
| FileHash-SHA256 | 6ed5d50cf9d07db73eaa92c5405f6b1bf670028c602c605dfa7d4fcb80ef0801 | SHA256 of 423d9b37ef7155c3c36b71ca7f3e6ae154e212e8 |
| FileHash-SHA256 | 7ba47558c99e18c2c6449be804b5e765c48d3a70ceaa04c1e0fae67ff1d7178d | SHA256 of aeb2a53e9c8730c2cbd15d620c001d0501e4bb91 |
| FileHash-SHA256 | 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a | SHA256 of 5ab806618497189342722d42dc382623ac3e1b55 |
| FileHash-SHA256 | 8d950068f46a04e77ad6637c680cccf5d703a1828fbd6bdca513268af4f2170f | SHA256 of 4e131910e0080799d86aceee036c0e288c0ae6bf |
| FileHash-SHA256 | 8e43d1ddbd5c129055528a93f1e3fab0ecdf73a8a7ba9713dc4c3e216d7e5db4 | |
| FileHash-SHA256 | 918784e25bd24192ce4e999538be96898558660659e3c624a5f27857784cd7e1 | |
| FileHash-SHA256 | 951b1b5fd5cb13cde159cebc7c60465587e2061363d1d8847ab78b6c4fba7501 | SHA256 of 7f66f109db5f30e17bc4a6705acbcace123c2765 |
| FileHash-SHA256 | 95a922e178075fb771066db4ab1bd70c7016f794709d514ab1c7f11500f016cd | SHA256 of c9f0c40e012f8cfe20b1e5cd6a9a7b078e89a00b |
| FileHash-SHA256 | 97766464d0f2f91b82b557ac656ab82e15cae7896b1d8c98632ca53c15cf06c4 | |
| FileHash-SHA256 | a48ac157609888471bf8578fb8b2aef6b0068f7e0742fccf2e0e288b0b2cfdfb | SHA256 of 38b53a8767a1c0d7ad774548780e5e071fa0414a |
| FileHash-SHA256 | a9ca77dfe03ce15004157727bb43ba66f00ceb215362c9b3d199f000edaa8d61 | |
| FileHash-SHA256 | be922312978a53c92a49fefd2c9f9cc098767b36f0e4d2e829d24725df65bc21 | SHA256 of 253ba984e247c640fa2c6fe1f93cafdc2d1df573 |
| FileHash-SHA256 | d1f718d219930e57794bdadf9dda61406294b0759038cef282f7544b44b92285 | SHA256 of a57cbd620c3dad284b5d88d1cf5fa0d2cd44c4b9 |
| FileHash-SHA256 | d3247f03dcd7b9335344ebba76a0b92370f32f1cb0e480c734da52db2bd8df60 | SHA256 of 630ccb6bea18f6224f830216273297ae0bb43718 |
| FileHash-SHA256 | d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c | SHA256 of 1ca7e6ac6128bb1f4e0318a28310525baf7c67c6 |
| FileHash-SHA256 | d689cb1dbd2e4c06cd15e51a6871c406c595790ddcdcd7dc8d0401c7183720ef | SHA256 of f02e06bc439a28aad6dd957df8d0022f22798a09 |
| FileHash-SHA256 | dcdb9bd39b6014434190a9949dedf633726fdb470e95cc47cdaa47c1964b969f | SHA256 of b03d70220e185124be9189d979026810d002a6cb |
| FileHash-SHA256 | de73b73eeb156f877de61f4a6975d06759292ed69f31aaf06c9811f3311e03e7 | SHA256 of e65d43d47fc1cab8359906711631beba78ab23b5 |
| FileHash-SHA256 | ed05f5d462767b3986583188000143f0eb24f7d89605523a28950e72e6b9039a | SHA256 of cad5355c534cccf48ca8df5a1007cc34d37cb619 |
| FileHash-SHA256 | edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef | SHA256 of 0098c79e1404b4399bf0e686d88dbf052269a302 |
| FileHash-SHA256 | fdadb6e15c52c41a31e3c22659dd490d5b616e017d1b1aa6070008ce09ed27ea | SHA256 of 1f5b5e40c420f64aa8e8de471367e3decc9763cd |
| [email protected] | ||
| [email protected] | ||
| FileHash-MD5 | 07ed30d2343bf8914daaed872b681118 | MD5 of fdadb6e15c52c41a31e3c22659dd490d5b616e017d1b1aa6070008ce09ed27ea |
| FileHash-MD5 | 136f9205a5945681ec470b8461dfee5f | MD5 of d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c |
| FileHash-MD5 | 14b2f5291036be454ae2fc762ff6eaaa | MD5 of 5e55b4caf47a248a10abd009617684e969dbe5c448d087ee8178262aaab68636 |
| FileHash-MD5 | 1b9f1a75593dfc670fa7c54659ab5796 | MD5 of 95a922e178075fb771066db4ab1bd70c7016f794709d514ab1c7f11500f016cd |
| FileHash-MD5 | 24a648a48741b1ac809e47b9543c6f12 | MD5 of 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b |
| FileHash-MD5 | 2691d7f266050e6849793d4b6661dddf | MD5 of 951b1b5fd5cb13cde159cebc7c60465587e2061363d1d8847ab78b6c4fba7501 |
| FileHash-MD5 | 2a23848ac28d73352ba80584327ff713 | MD5 of 8d950068f46a04e77ad6637c680cccf5d703a1828fbd6bdca513268af4f2170f |
| FileHash-MD5 | 31e8e12d02a6cac9088d89215cf4552c | MD5 of 13fd3ad690c73cf0ad26c6716d4e9d1581b47c22fb7518b1d3bf9cfb8f9e9123 |
| FileHash-MD5 | 3d4112b92a8285d8661bbc29125bdbf5 | MD5 of a48ac157609888471bf8578fb8b2aef6b0068f7e0742fccf2e0e288b0b2cfdfb |
Referencias
https://www.cynet.com/blog/rhysida-the-ransomware-gang-strikes-again/
https://www.ransom-db.com/ransomware-groups
