oktober 7, 2021
SentinelOne Vs. Spook Ransomware – Mitigation and Rollback
Watch how SentinelOne mitigates and rolls back Spook Ransomware. Spook ransomware emerged onto the scene in late September/early October 2021. The group, mirroring the manifestos of others, boasts “very strong (AES) encryption” along with the threat of leaking victim data to the public. Spook malware has the ability to encrypt target machines without requiring internet connectivity. Encryption of a full disk can occur within just a few minutes, at which point the ransom note is displayed on the desktop (RESTORE_FILES_INFO.HTA) along with numerous other system notifications.
The malware also makes a number of changes to ensure that the ransom notifications are displayed prominently after reboot (via Start Menu lnk, Reg). In addition, Spook will also attempt to terminate processes and stop services of anything that may inhibit the encryption process.
This is handled between taskill.exe and sc.exe. Additonal persistence mods are made via reg.exe and schtasks.exe.
Spook maintains a blog for ‘non-compliant’ victims. The blog was made live in early October 2021. As of this writing, there are 17 victims posted to the Spook blog, from varying industries across the globe.
Gerelateerde resources
Resource
SentinelOne PartnerOne - America's 2025
⛳️ Last week in Pebble Beach the America's best cybersecurity partners came together for our annual PartnerOne summit. Check out…
View Asset
Resource
Just a Sec: Cybersecurity Unfiltered—Fast, Frank, and From the Front Lines
Welcome to the first-ever Just A Sec, a no-holds-barred, quick-fire monthly livestream. It’s cybersecurity like you’ve never heard it before—unfiltered,…
View Asset