2020-10-23 23:40:20
分析本月勒索病毒家族占比:phobos家族占比23.89%居首位;其次是占比17.00%的Crysis;GlobeImposter家族以占比16.60%位居第三。本月新增的勒索并未有大量传播态势,针对NAS(网络附属存储)设备进行攻击的Ech0raix勒索病毒在本月再度活跃,并成功打入前十。
图1. 2020年09月勒索病毒家族占比
从被感染系统分布看:本月位居前三的系统是:Windows 10、Windows7和Windows Servers 2008。而从本月被感染设备数据看,NAS类设备再次被黑客作为攻击目标。
图2. 2020年09月被感染系统占比
2020年09月被感染系统中桌面系统和服务器系统占比显示,受攻击的主要系统仍是个人桌面系统。被攻击的NAS设备占少部分。
以下是本月搜集到的黑客邮箱信息:
x3m@usa.com |
tools1990m@gmail.com |
decryptor666@420blaze.it |
AESMew@pm.me |
crypto0077@gmail.com |
newhelper24@protonmail.ch |
rx99@cock.li |
De-crypt@foxmail.com |
sookie.stackhouse@gmx.com |
murryu@aol.com |
rdp571@protonmail.ch |
Ctorsenoria@ttutanota.com |
cryhelp@dr.com |
maedeh81@firemail.cc |
SurpriseN1@protonmail.com |
pewpew@TuTa.io |
newrecoverybot@pm.me |
alexwind46@protonmail.com |
r4ns0m@cock.li |
xilttbg@tutanota.com |
sorcinacin@protonmail.com |
alfryy@cock.li |
PabFox@protonmail.com |
neyhyretim@protonmail.com |
l_crypt@aol.com |
Sidmouleux996@aol.com |
securityteamex@yandex.com |
FoxHelp@cock.li |
virus@countermail.com |
MikeyMaus77@protomail.com |
epicday@cock.li |
Genovo@protonmail.com |
rdpconnect@protonmail.com |
moncler@cock.li |
crioso@protonmail.com |
Steven77xx@protonmail.com |
mr.yoba@aol.com |
akzhq808@tutanota.com |
TeslaBrain@protonmail.com |
mk.rain@aol.com |
filerestory@gmail.com |
unlock0101@protonmail.com |
mk_rain@aol.com |
btcsupport@msgsafe.io |
Founder94@yakuzacrypt.com |
jacdecr@tuta.io |
sambolero@tutanoa.com |
johnsonwhate@tutanota.com |
js3010@rape.lol |
best@desharonline.top |
decrypter02@cumallover.me |
newbang@cock.li |
mrromber@tutanota.com |
getthefiles2@protonmail.ch |
M0rphine@cock.li |
decoderforyou@cock.li |
leakthemall@protonmail.com |
Helpsir@rape.lol |
immunityyoung@aol.com |
suppdecrypt@protonmail.com |
operator3@qq.com |
pewpew@Protonmail.Com |
notesteam2018@tutanota.com |
decrypt@rape.lol |
polssh@protonmail.com |
MayarChenot@protonmail.com |
decrypt20@vpn.tg |
lewismccown@yahoo.com |
michael.reynolds74@aol.com |
corebitp@cock.li |
ultrasert77@gmail.com |
yourlastchancehelp@cock.li |
mk.kabal@aol.com |
blair_lockyer@aol.com |
unlockme123@protonmail.com |
d.fedor2@aol.com |
ww6666@protonmail.com |
Decryptions@protonmail.com |
mk.smoke@aol.com |
farik1@protonmail.com |
blackroot54@protonmail.com |
Rezcrypt@cock.li |
pittt@prt-decrypt.xyz |
darkencryptor@tutanota.com |
bosxsxsx@cock.li |
support@p-security.li |
recowerdata@protonmail.com |
repairdb@mail.fr |
2k19sys@p-security.li |
jimmtheworm@dicksinmyan.us |
1rest0re@cock.li |
wecanh3lpyou2@cock.li |
Recoverybat@protonmail.com |
BatHelp@india.com |
wecanhelpyou@elude.in |
klowershit1835@tutanota.com |
rdpunlock@cock.li |
rdpmanager@airmail.cc |
decoder83540@protonmail.com |
mrromber@cock.lii |
gomer@horsefucker.org |
immunityyoung@aol.com.young |
Crypt@zimbabwe.su |
piterpen02@keemail.me |
viruszone4209@opentrash.com |
dcr@cumallover.me |
BatHelp@protonmail.com |
e95c12d08b14@protonmail.com |
swhost@msgsafe.io |
ThunderBirdXeX@cock.li |
support@all-ransomware.info |
coryell.r@aol.com |
russiawolf09@gmail.com |
nemesis-decryptor@india.com |
alexbanan@tuta.io |
05250lock@tutamail.com |
BackFileHelp@protonmail.com |
pay@cyberdude.com |
reidcry@hackermail.com |
cryptofiles@horsefucker.org |
mk.baraka@aol.com |
fartcool@protonmail.ch |
decodeodveta@protonmail.com |
m.reptile@aol.com |
rdp_unlock@outlook.com |
mzrdecryptorbuy@firemail.cc |
m.subzero@aol.com |
777decoder777@tfwno.gf |
helptounlock@protonmail.com |
SuckBaBe@Rape.LoL |
polssh1@protonmail.com |
johnsonwhate@protonmail.com |
A654763764@qq.com |
rizonlocker@airmail.cc |
remotePChelper@tutanota.com |
doctor666@mail.fr |
BhatMaker@tutanota.com |
filemaster777@protonmail.com |
doctor666@cock.li |
divevecufa@firemail.cc |
deloneThunder@protonmail.com |
support@lzt.design |
elfbash@protonmail.com |
777decoder777@protonmail.com |
prndssdnrp@mail.fr |
Adamfox69@criptext.com |
decoderforyou@protonmail.com |
decrypt@europe.com |
admcphel@protonmail.ch |
SuzuMcpherson@protonmail.com |
vulicapson@cock.lu |
petrus34@p-security.li |
securityit123@protonmail.com |
vulicapson@tuta.io |
decryptdocs@msgsafe.io |
jacksteam2018@protonmail.com |
rightcheck@cock.li |
montanarecover@aol.com |
loyaldecrypt@privatemail.com |
berstife@gmail.com |
montanarecover@cock.li |
caizonatu1987@protonmail.com |
linajamser@aol.com |
data_cloud2012@aol.com |
nowabosag1988@protonmail.com |
databack44@tuta.io |
x3m-pro@protonmail.com |
DharmaParrack@protonmail.com |
endereless@cock.li |
contactsupport@cock.li |
paradise@all-ransomware.info |
SurpriseN1@aol.com |
helpdesk_nemty@aol.com |
cyber.duskfly@protonmail.com |
epicday@airmail.cc |
FilesHelp@tutanota.com |
don-corleone@mortalkombat.su |
alexwind46@aol.com |
RestoreData@airmail.cc |
letitbedecryptedzi@gmail.com |
badbeeteam@cock.li |
softs98@protonmail.com |
Mr.TeslaBrain@protonmail.com |
badbeeteam@mail.ee |
blacklivesatter@qq.com |
Filedecryptor@protonmail.com |
file@p-security.li |
newbang@protonmail.com |
repairdatadochelp@airmail.cc |
decodor@airmail.cc |
Founder94@tutanota.com |
ellenfabiana01@protonmail.com |
mk.kunglao@aol.com |
alfryy@yakuzacrypt.com |
coincidenceleague@firemail.cc |
asmo49@asmodeus.us |
newrecoveryrobot@pm.me |
RemotePChelper@protonmail.com |
Hiddenhelp@cock.li |
RemotePChelper@cock.li |
dogeremembersss@protonmail.ch |
recovery94@cock.li |
BCPFILE17@tutanota.com |
paologaldini2020@tutanota.com |
teslabrain@cock.li |
doctorhelp2120@cock.li |
befittingdavid@protonmail.com |
giveyoukey@cock.li |
SpadeFiles@tutanota.com |
pebawestsa1973@protonmail.com |
sqlbackup3@mail.fr |
blacklivesmatter@qq.com |
nespabatbe1989@protonmail.com |
repairdb@seznam.cz |
ataback2@protonmail.com |
indilacons1975@protonmail.com |
returndb@seznam.cz |
tchukopchu@tutanota.com |
chocolate_muffin@tutanota.com |
support911@cock.li |
Folielol@protonmail.com |
restoring.data@protonmail.com |
file-cloud@email.tg |
AsuxidOruraep1999@o2.pl |
babyfromparadise666@gmail.com |
zimbabwe@msgsafe.io |
buransupport@exploit.im |
legion.developers72@gmail.com |
grdoks@tutanota.com |
recovery1server@cock.li |
RECOVERUNKNOWN@protonmail.com |
bestcool@keemail.me |
e95c12d08b14@airmail.cc |
AdvancedBackup@protonmail.com |
Writeme4@airmail.cc |
rizonlocker@firemail.cc |
Black.Berserks@protonmail.com |
Chadmad@nuke.africa |
puckett_jeffrey@aol.com |
olgearreabo1989@protonmail.com |
greenreed007@qq.com |
immortalsupport@cock.li |
coincidenceleague@tutanota.com |
Daves.smith@aol.com |
decryptdocs@firemail.cc |
recovery_server@protonmail.com |
decryp7@foxmail.com |
macgregor@aolonline.top |
gustafkeach@tohaveandtohold.us |
Datarest0re@aol.com |
deyscriptors1@india.com |
luizunwrite2020@protonmail.com |
datarest0re@xmpp.jp |
yotabyte@protonmail.com |
surguitenve1986@protonmail.com |
fixallfiles@tuta.io |
liukang@mortalkombat.su |
wyattpettigrew8922555@mail.com |
VASHMAIL@KEEMAIL.ME |
dd.coala@protonmail.com |
your_last_chance_help@elude.in |
helpdesk_mz@aol.com |
dcyptfils@protonmail.ch |
leltitbedecrypteddzi@gmail.com |
Deus69@criptext.com |
Helpcrypt1@tutanota.com |
Black.Berserks@yakuzacrypt.com |
returndb@airmail.cc |
Mr.TeslaBrain@gmail.com |
imBoristheBlade@protonmail.com |
Recoverybat@cock.li |
Bitdefender2020@cock.li |
gaetwelsenba1983@protonmail.com |
returndb@airmail.ee |
vashmail@protonmail.com |
profhandgomo1989@protonmail.com |
Filesback@keemail.me |
Decfile431@tutanota.com |
phrasitliter1981@protonmail.com |
nekross@tutanota.com |
smartrecav@tutanota.com |
coincidenceleague@thesecure.biz |
BatHelp@tutanota.com |
Jonbrown88@criptext.com |
nicenphacock1976@protonmail.com |
FoxHelp@tutanota.com |
gomersimpson@keemail.me |
glocadboysun1978@protonmail.com |
John91Done@yahoo.com |
decryptor911@airmail.cc |
DecrypterSupport@protonmail.com |
Chadmad@ctemplar.com |
1rest0re@protonmail.com |
Recoveryhelp2019@protonmail.com |
decoder83540@cock.li |
MREncptor@protonmail.com |
filedownload2020@protonmail.com |
buransupport@xmpp.jp |
gustav.strasserg@gmx.com |
coftocounbio1977@protonmail.com |
happyless@airmail.cc |
Ctorsenoria@tutanota.com |
decoding_help8888@protonmail.com |
johnsmith654@cock.li |
ITAmbuler@protonmail.com |
guifullcharti1970@protonmail.com |
johnsmith456@cock.li |
bavaria54@protonmail.com |
coincidenceleague@protonmail.com |
sanio.marino@aol.com |
nic.shulz@protonmail.com |
supp0rtdecrypti0n@protonmail.com |
bullockcraig@aol.com |
BhatMaker@protonmail.com |
sxvcsacobyzurlock@protonmail.com |
decryptor@cock.email |
recowery1servers@cock.li |
StephanVeamont1997C@tutanota.com |
stopcrypt@cock.email |
greenreed911@foxmail.com |
carbedispgret1983@protonmail.com |
VictorLustig@gmx.com |
backtonormal@foxmail.com |
SupportMIICCSSetup@protonmail.com |
alexwind46@yahoo.com |
fiasco911@protonmail.com |
sookie_stackhousse@protonmail.com |
augusto.ruby@aol.com |
server-support@india.com |
ScorpionEncryption@protonmail.com |
mecybaki@firemail.cc |
contact-support@elude.in |
ScorpionEncryption@Protonmail.com |
opensafezona@cock.li |
Honeylock@protonmail.com |
ScorpionEncryption@yakuzacrypt.com |
blackblackra@tuta.io |
recover85@protonmail.com |
your_last_chance_help@protonmail.com |
w3canh3lpy0u@cock.li |
josefrendal797@gmail.com |
MariaJackson2019williams@protonmail.com |
karnel.fikol@aol.com |
helper571@protonmail.com |
MariaJackson2020williams@protonmail.com |
TeslaBrain@gmail.com |
maedeh81@yakuzacrypt.com |
表格1. 黑客邮箱
针对服务器的勒索病毒攻击依然是当下勒索病毒的一个主要方向,企业需要加强自身的信息安全管理能力——尤其是弱口令、漏洞、文件共享和远程桌面的管理,以应对勒索病毒的威胁,在此我们给各位管理员一些建议:
发现中勒索病毒后的正确处理流程:1.发现中毒机器应立即关闭其网络和该计算机。关闭网络能阻止勒索病毒在内网横向传播,关闭计算机能及时阻止勒索病毒继续加密文件。2.联系安全厂商,对内部网络进行排查处理。3.公司内部所有机器口令均应更换,你无法确定黑客掌握了内部多少机器的口令。
后续安全防护建议:
1. 多台机器,不要使用相同的账号和口令
2. 登录口令要有足够的长度和复杂性,并定期更换登录口令
3. 重要资料的共享文件夹应设置访问权限控制,并进行定期备份
4. 定期检测系统和软件中的安全漏洞,及时打上补丁。
5. 定期到服务器检查是否存在异常。查看范围包括:
(1) 是否有新增账户
(2) Guest是否被启用
(3) Windows系统日志是否存在异常
(4) 杀毒软件是否存在异常拦截情况
6. 安装安全防护软件,并确保其正常运行。
7. 从正规渠道下载安装软件。
8. 对不熟悉的软件,如果已经被杀毒软件拦截查杀,不要添加信任继续运行。
此外,无论是企业受害者还是个人受害者,都不建议支付赎金。支付赎金不仅变相鼓励了勒索攻击行为,而且解密的过程还可能会带来新的安全风险。
常见的勒索病毒,很多只加密文件头部数据,对于某些类型的文件(如数据库文件),可以尝试通过数据修复手段来挽回部分损失。如果不得不支付赎金的话,可以尝试和黑客协商来降低赎金价格,同时在协商过程中要避免暴露自己真实身份信息和紧急程度,以免黑客漫天要价。由于第三方均是通过联系黑客购买密钥解密文件,所以尽量避免咨询太多第三方(咨询太多第三方相当于咨询多次黑客,会导致黑客涨价。)