'It is unlikely that the operators behind the ‘pirated software’ malware are the same as the ones who launched the Ryuk attack,' said Peter Mackenzie, manager of Rapid Response at Sophos.

However, instead of receiving the expected software, they were infected with an information-stealing trojan that logged keystrokes, stole the Windows clipboard history, and stole passwords, including the same credentials used by the Ryuk threat actors to log into the institute. Instead of buying the license for a few hundred dollars, the student searched for a cracked version and downloaded it from a warez site. As part of this cooperation, the institute provides the students with login credentials to log into their network remotely.Īfter gaining access to the student's laptop and analyzing the browser history, they learned that the student had searched for an expensive data visualization software tool that they used at work and wanted to install on their home computer. The institute works with university students who assist in research and other tasks. This attack lost the institute a week's worth of research data and a week-long network outage as servers were rebuilt from scratch and data restored from backups.Īfter performing forensics on the attack, Sophos determined that the initial point-of-entry for the threat actors was an RDP session using a student's credentials. Fake crack leads to a Ryuk ransomware attackĪfter the research institute suffered a Ryuk ransomware attack, Sophos' Rapid Response team responded and neutralized the cyberattack. In the past, we have seen crack sites distribute ransomware, such as STOP and the Exorcist ransomware, cryptocurrency miners, and information-stealing trojans.

Death note download torrent pirate