Microsoft Exchange servers hit by Black Kingdom ransomware – Bits Media

In early March, Microsoft Exchange's postal servers found Proxylogon vulnerability, allows you to execute arbitrary code, And now with its help, hackers are distributed by the Black Kingdom-Sipper virus.

Computer Security Specialist Marcus Khatchins (Marcus Hutchins) discovered, that attackers, gaining access to servers through Proxylogon vulnerability, Using the script on PowerShell, download the executable cipher files and apply them to other computers on the network. At the same time, during the tests, Hatchins did not occur encryption - just created files demanding a ransom.

maybe, Khatchins came across the first version of the virus, because, According to data from ID Ransomware, The first infection of the Black Kingdom virus began 18 Marta and currently their number exceeds 30. The victims of the virus were companies from various countries, including Russia, USA, France, Israel and Germany.

After infection of the computer, the virus encrypts files and renames them in random order. Seems to be, Attackers use the same address
To get a ransom. However, and the amount of redemption is the same - $ 10,000 in bitcoins. At this moment, hackers received only one payment.

Summer 2020 Cases of infection with a virus called Black Kingdom have already occurred years, Although it is still unknown, Is this virus identical to the new. However, Both viruses are written in Python programming language.

PROXYLOGON previously vulnerabilities have used the Darcry virus spread, However, there were very few cases of infection. It also became known, that the hacker group Revil requested $50 Milln in bitcoins from the manufacturer of computer equipment Acer. Probably, Hackers penetrated the Acer network as a result of using Proxylogon vulnerability.