A new ransomware family called ‘NamPoHyu Virus’ or ‘MegaLocker Virus’ is targeting victims a bit differently than other ransomware. Instead of an executable running on a victim’s computer, the attacker is running the ransomware locally and having it remotely encrypt over half a million accessible Samba servers.
‘NamPoHyu Virus’ Ransomware Targets Remote Samba Servers: A new ransomware family called NamPoHyu Virus or MegaLocker Virus is targeting victims a bit differently than other ransomware. Instead of an executable running on a victim's computer, the… https://t.co/AMoipn0XEr
— Sanzu © 🇪🇸 (@N4chelus) April 17, 2019
Roy Rashti, Cybersecurity Expert at BitDam:
The first thing users can do to protect themselves is, of course, use a strong password. Brute forcing passwords is a path most traveled by attackers and a unique, personal password must be in place. In addition, the access to the servers should be restricted by a VPN, so no scanners are able to detect that this server exists in the first place, nor can it be registered on platforms like Shodan.
The cleverness and creativity of the attackers means they keep finding new ways to affect users’ data and servers. Users must always be prepared for the worst: implement every security solutions that might help to protect them, keep backups of their data and always be on guard.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.