Threat Intelligence Report January 25th - January 31st 2021

The Red Piranha Threat Intelligence team uncovered an intricate cybersecurity attack targeting over eighty Australian businesses. Our team quickly crushed the threat by reverse-engineering the campaign and tools the attacker utilised, allowing them to locate and notify the affected parties swiftly. The cybercriminals used a technique to reject the victim's passwords three times, ensuring they gathered the maximum account of credentials without the user growing too suspicious. 

FonixCrypter ransomware gang throws in the towel with MasterKey release 

Well known ransomware-as-a-service cybergang FonixCrypter (also known as Xinof) has recently ceased its entire operations, leaving their life of crime behind.  

Taking the industry by surprise, they announced via Twitter, that they had “Come to the conclusion we should use our abilities in positive ways and help others.” In addition to apologising to their victims as a sign of good faith, they released their MasterKey, deleted the ransomware source code and closed their Telegram channel, in which they used to advertise their malware campaigns in the dark web. 

We recommend that those affected by FonixCrypters ransomware do not use the tool published and instead wait for a tool from an official source to decrypt their files as there is no guarantee that this tool is not in itself malicious.