Introduction
The ransomware group Hunters International has attacked over 200 organizations worldwide since its appearance in October 2023. A detailed Analyze by Forescout Vedere Labs highlights the methods of these cybercriminals and shows how companies can protect themselves.
Technical characteristics of the malware
The ransomware written in Rust by Hunters International is particularly adaptable. This property enables it to bypass detection systems and ensure a high encryption speed. The malware exhibits similarities to the Hive ransomware, but the command-line options have been streamlined and the key management optimized.
Anatomy of an Attack
The researchers were able to reconstruct the sequence of a specific attack. The initial compromise occurred via modified AutoIt malware or the exploitation of an Oracle WebLogic Server. After the compromise, the attackers reconnoitered the network, gathered credentials, and exfiltrated data via the file-sharing service MEGA.
Recommendations for prevention
The analysis emphasizes the importance of security measures such as monitoring debug ports, detecting webshell commands, and protecting against credential dumping. A functional backup system protected against tampering is essential.
Legal aspects and support
With the increasing complexity of cyber threats, compliance with regulations such as the GDPR is becoming increasingly important. Companies should seek legal support to prevent security incidents. The law firm ATB.LAW offers comprehensive advice on cybercrime and compliance. Contact by e-mail: office@atb.law or by phone at +43 1 3912345.
