Introduction
(Acronis) This ransomware family was first spotted in October 2019, but it was not very active at that time. The group behind it was independent in the beginning, but they recently joined the so-called Maze cartel – combining forces to rob individuals and companies around the world.
Activities and Tactics
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
- 000 Patients
- 2020-05
- 2020-08
- 2020-09
- 2020-10
- MU Health Care Phishing Attack Impacts 5
- Ransomware gang attacks Texas unit of global steel conglomerate
- Ransomware gangs add DDoS attacks to their extortion arsenal
- SunCrypt Ransomware sheds light on the Maze ransomware cartel
- SunCrypt Ransomware shuts down North Carolina school district
- University Hospital New Jersey hit by SunCrypt ransomware
- data leaked
- https://itwire.com/security/ransomware-gang-attacks-texas-unit-of-global-steel-conglomerate.html
- https://www.bleepingcomputer.com/news/security/ransomware-gangs-add-ddos-attacks-to-their-extortion-arsenal/
- https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/
- https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-shuts-down-north-carolina-school-district/
- https://www.bleepingcomputer.com/news/security/university-hospital-new-jersey-hit-by-suncrypt-ransomware-data-leaked/
- https://www.hipaajournal.com/mu-health-care-phishing-attack-impacts-5000-patients/
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- SunCrypt
- WARPRISM
- SunCrypt:
- WARPRISM:
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
References pending cataloguing.