article thumbnail

Ragnar Ransomware encrypts files from virtual machines to evade detection

Security Affairs

One of the victims of the ransomware is the energy giant Energias de Portugal (EDP) , where the attackers claimed to have stolen 10 TB of files. “In addition to the VirtualBox files, the MSI also deploys an executable (called va.exe), a batch file (named install.bat), and a few support files.

article thumbnail

A new piece of Snake Ransomware targets ICS processes

Security Affairs

Then the malware encrypts the files on the system, skipping Windows system files and folders. The SNAKE ransomware appends a ransom 5 character string to the files extension (i.e. a file named invoice.doc is encrypted and renamed like invoice.docIksrt. One such example would be Project Root. Pierluigi Paganini.