Insights For Success

Strategy, Innovation, Leadership and Security

Ransomware

More Ransomware gang tor darknet sites

GeneralEdward Kiledjian
anonymous-2821433.jpg

I wrote a blog post about popular ransomware group TOR (darknet) showcase sites (here).

The purpose of this entry is to add additional sites to the list (so you should check that one out first).

Astro Tream

anewset3pcya3xvk73hj7yunuamutxxsm5sohkdi32blhmql55tvgqad.onion

Untitled.png

CUBA FREE

cuba4mp6ximo2zlo.onion

Untitled.png

Babuk Ransomware

wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion

Untitled.png

Ragnarok ransomware

wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion

Untitled.png

Everest Ransomware

ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion

Untitled.png

Ransomex ransomware

rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion

Untitled.png

Popular Ransomware Darknet showcase websites

GeneralEdward Kiledjian
ransomware-5231739.jpg

The recent explosion of breaches by the CL0P Ransomware gang has renewed an interest in the darkweb showcase sites used by these threat actors to prove that they successfully broken into a company and to encourage victims to pay, Many have asked me to share some of these site and I was always hesitant. I recently learned that some “consultants” are charging customers to provide these publicly available links, which is wrong.

Most of these are on the TOR darkweb so you will have to use a TOR browser or VPN that bridges to TOR.


Mobikwik Indian data leak

mobikwikoonux37wauz6oqymshuvebj5u763rutlogc2fb2o3ugcazid.onion

Screen Shot 2021-03-30 at 9.05.08 AM.png


Cl0p ransomware gang

http://ekbgzchl6x2ias37.onion/

Screen Shot 2021-03-04 at 3.22.54 PM.png

DopplePaymer

http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion/

Screen Shot 2021-03-04 at 3.24.22 PM.png

AKO group

http://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion/

Screen Shot 2021-03-04 at 3.26.22 PM.png

Ragnar Locker

p6o7m73ujalhgkiv.onion

Screen Shot 2021-03-04 at 3.28.18 PM.png

Nefilim Group

hxt254aygrsziejn.onion

Screen Shot 2021-03-04 at 3.29.38 PM.png

Avaddon Ransomware

http://avaddongun7rngel.onion/

Screen Shot 2021-03-04 at 3.42.55 PM.png

Darkside Group

darksidedxcftmqa.onion or darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion

Screen Shot 2021-03-04 at 3.44.31 PM.png

Suncrypt

nbzzb6sa6xuura2z.onion

Screen Shot 2021-03-04 at 3.46.55 PM.png

REvil Ransomware

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

Screen Shot 2021-03-04 at 3.51.43 PM.png

Mount Locker

http://mountnewsokhwilx.onion/

Screen Shot 2021-03-04 at 3.57.10 PM.png

Pay2Key Leaks

pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion

Screen Shot 2021-03-04 at 4.04.45 PM.png

Lockbit Ransomware

http://lockbitkodidilol.onion/

Screen Shot 2021-03-04 at 4.12.47 PM.png

Ragnarok Leaks

wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion

Screen Shot 2021-03-04 at 4.15.37 PM.png

GrandCrab Ransomware As A Service (RaaS)

GeneralEdward Kiledjian

What is GrandCrab?

GrandCrab is a successful ransomware that encrypts files on the infected machine and demands payment to decrypt them.

Easy Money

What is you are a horrible human being willing to make gains from the suffering of others but you are lazy. You want to screw other people but don’t want to spend the time setup your own Command and control server? You don’t want to customize the malware to talk to your C2 server?

This is where Ransomware as a Service comes in.

Enter GrandCrab as a Service http://gandcr4cponzb2it.onion/

The offering

The GrandCrab RaaS has two tiers:

  • Standard at $230

  • Premium at $600

Standard Service

  • You can change and customize your ransomware

  • Name of the project

  • Change the demand of ransom

  • A description to help the victim in format .HTML, .PHP

  • You can change the logo, Remove GandCrab logo

  • You can choose the extension for example photo.png.gdb

  • Priority support

  • Automatically updated since the category (Ransom Builder)

  • The victim can pay you in Bitcoin or Dash

  • Withdrawal in Bitcoin or Dash

  • We will touch 10% fees ransom

  • You can add 3 users different free

  • You can create 3 ransomware

  • Victims can you contact by chat directly, you can also ban

  • You will have news about the dashboard

  • Geolocation victims infected

  • Show the IP of the victim

  • Manage the keys of decryption

  • You will be able to manage all the victims since the dashboard

  • With several possibilities

  • You can infected in unlimited

  • You can see the blockchain explorer

  • Spreading automatically without providing any effort or you can also spread manually

  • You will have full access to our forum with the rank Platinum (forum under construction soon available)

  • Victim URL automatically generated in .onion customize your own URL

  • View antivirus report in real time

  • Lifetime license !

  • Theme only white

Premium Service

  • The same features different even more fun

  • You receive 100% of the ransom paid by the victims no commission fees

  • Ransomware automatically updated by our support

  • Victims can you contact by chat directly, you can also ban

  • Spreading automatically without providing any effort or you can also spread manually

  • The victim can pay you in Bitcoin or Dash and Monero !

  • Withdrawal in Bitcoin, Dash, Monero

  • Automatically increases the ransom if no payment of the victim

  • Choose your own delete time

  • Create up to 10 different ransomware

  • You can add 8 users different free

  • Make the ransomware in format .pdf

  • bulletproof hosting, server VPN

  • Priority support by ticket since dashboard

  • Change all the logo, An icon in format .ICO, Remove the gandcrab logo, Add an animated logo in .GIF

  • Manage all the victims since the dashboard

  • You will have a fully functional 2019 tutorial to teach you, In format .pdf .mp4

  • Assignment on multiple computers in seconds from the same WIFI network

  • Undetectable by antivirus update regularly

  • Victim URL automatically generated in .onion customize your own URL

  • You can infected in unlimited

  • Manage the keys of decryption

  • Change the theme ransomware

  • You can see the blockchain explorer

  • Geolocation victims infected

  • You can also see the operating system

  • Show the IP of the victim

  • You will have full access to our forum with the rank Gold (forum under construction soon available)

  • You will have the ransomware source code, contact us from the dashboard with your login only for premium members

  • View antivirus report in real time

  • Crypter fud

  • Lifetime license !

  • Theme dashboard white, black

Conclusion

The conclusion is that security is hard and hackers are learning about the benefits of offering “things as a service” and using cloud to reduce costs. Attacking is become cheaper while protecting our organizations is becoming more costly

How to protect your PC from infection

GeneralEdward Kiledjian

Think of all the valuable data your PC contains (pictures, files, invoices, contacts, etc). Now imagine losing all of that data Virus' are still a thing but you should be more worried about ransomware, worms and all of the other digital creepy crawlies roaming the net looking to make you their next victim.

Go read my article entitled "How to secure Windows 10".

Backup everything, then back it up again

In 2012, I wrote an article entitled "The best way to protect your data - images, music, documents". The main point is that you should always remember the 3-2-1 rule of backups:

  1. Have 3 copies of all of your important data (1 primary and 2 backups)
  2. Make sure your 2 backups are on separate media technologies (e.g.1 on a hard drive and the other in the cloud or 1 on a hard drive and the other on a tape backup)
  3. 1 of your backups should be offsite in a remote location that would not be impacted by a major disaster that hits your area (e.g. in the cloud).

The advantage of most cloud backups is that they support version control which means if you infect your files with ransomware, you can always go back to  a known good version. My backup strategy involves:

  1. 1 primary version of my data and a local hard drive backup
  2. 1 complete synchronization of my files on a fully encrypted trust no one online storage service
  3. 1 complete backup using a remote backup service (like backblaze or carbonite)

Update everything

WannaCry created an incredibly outcry in the tech world with thousands of companies getting infected in hundreds of countries. The truth is that an update published 2 months prior patched that vulnerability. Updating computers in large companies is complicated but your home PC shouldn't be.

You must must must update your operating system and applications regularly to stay protected.

The latest version of the operating systems from Microsoft, Apple and Ubuntu are all configured to auto-update themselves. In addition to the OS, make sure you periodically check for application updates.

If you use an Apple Macintosh computer, you may even want to use something like MacUpdate Desktop to constantly check if any of your installed apps have updates available.

Leave the built-in firewall on

Some "Security" apps turn off the built in firewall but it is critically important to ensure it is always on. On Windows, you can turn if on/off with these instructions. You can find information about the Apple Mac application firewall here

Use an antivirus

The question I get asked the most often is should I buy a third party antivirus for my home computer and my answer is no. Anytime you add a third party tool, you increase the attack vector therefore rely on what Microsoft bundles with Windows 10. You can follow these instructions to change the Windows Defender Antivirus cloud-protection level to 10.

In February I wrote an article entitled "Companies buying bitcoin to prepare for cyber extortion" and in there included this paragraph:

Companies have started to jump on the Ransomware protection bandwagon. An EDR &”next-generation AV” company called Cybereason offers a free product called RansomFree. They claim it protects against 99% of ransomware by monitoring how applications interact with files on your computer. Did I mention RansomFree is free? I haven’t used their product and thus can’t recommend it but it does seem to be useful and could really help the average consumer ensure they don’t end up getting victimized.

You can run something like RansomFree on your home PC in addition to the Windows antivirus. 

Upgrade the fleshware

The truth is that even the best most advanced technology can't prevent an infection if the user does something stupid. Often users are the weakest link the the corporate security chain and you are no different. 

Using good security hygiene will go a long way to protecting you. Basic tips:

  • never open an attachment from a user you do not know well or that you are not expecting
  • never click on a link embedded in an email
  • never install applications from untrusted sources (including torrents or anything pirated)
  • Remember that you can also get infected from a website so use Google Chrome with the the Ublock Origin plug-in

What to do if you get infected?

If a user's PC or Mac does get infected, their first thought is to find someone that can clean it. The truth is that once your PC is infected, it can' really be cleaned properly or trusted. At that point, you must do  a clean re-installation from a known clean source and then recover your files from a known good backup.

Some technical support companies will offer cleanup services but don't do it. Once your PC is infected, you don't know what else could be lurking in the background waiting to strike again. The best course of action is to start fresh.

Hopefully you have backups and everything will work out just fine. If you don't have backups and your files are encrypted by ransomware, you can always check out a free online site called No More Ransom Project and see if they offer a free decryptor for your ransomware. There are no guarantees your infection strain has a decryptor but it doesn't hurt to check.