OldGremlin hacker group attacks Russian companies for bitcoin ransom

Group-IB cybersecurity company has discovered a new group of hackers called Oldgremlin, which spreads the robbers in Russian companies.

As Group-Ib analyst Oleg Skulkin said, Hackers from Oldgremlin use the new Tinycryptor Main Milger-Milk (decr1pt):

“So far, the goals of the group were companies exclusively from Russia. Wherein, According to the unspoken rules for Russian -speaking groups, Typically, firms from the post -Soviet space are bypassed ".

To infect user computers, personified phishing letters are used with attached infected ZIP files. After the opening of such a file, a Trojan called Tinynode is installed on the computer, What gives hackers the original point of entering the computer network of the victims. After that, they distribute the Symphorelier for the digital infrastructure of the company. Typically, attackers ask for a ransom of $ 50,000 for decryption of files.

According to Group-Ib, Oldgremlin attacks began around March this year. At the same time, hackers use various tricks in their letters, who must force a victim employee to open the attached file.

“If it's Russians, then such attacks are unusual, But they have already happened earlier. maybe, These are not Russians, But the inhabitants of the CIS. for instance, Ukrainian nationalists have an incentive to attack Russian companies ", - Skulkin believes.

Recently reported
About that, that the attack of the Symphanterian virus on the hospital of the University of Dusseldorf became an indirect cause of the death of the patient.

Source