Resources/YouTube Videos/SentinelOne VS DearCry Ransomware (Exploits Microsoft Hafnium Exchange Vulnerabilities) Protect Mode
March 13, 2021
SentinelOne VS DearCry Ransomware (Exploits Microsoft Hafnium Exchange Vulnerabilities) Protect Mode
Watch how SentinelOne protects from DearCry - new ransomware that exploits the Microsoft Exchange (Hafnium) vulnerabilities. For more details on Hafnium: https://lnkd.in/gUSDW_j
DearCry is a new ransomware that exploits the Microsoft Exchange vulnerabilities, known as Hafnium. The ransomware appears to have been deposited via webshell access on the targeted servers. The delivery mechanisms likely extend beyond that however. See how Sentinelone protects
DearCry creates a windows service (“msupdate”) which handles the bulk of the encryption duties. A hard-coded list of extensions to queue for encryption is included, and most common filetypes are covered in said list. After encryption, affected files will have their extension changed to “.CRYPT”. Encryption is fairly straightforward, appearing to make use of AES-256 for file/data encryption, while AES key is encrypted via RSA-2048. The ransomware will attempt to enumerate all logical, and accessible, drives for encryptable data. Victims are instructed to contact the attacker via email, with two addresses being provided in the ransom note.
#Lazarus #sentinellabs #infosec #cybersecurity #cyberattack #cyber #hacking #NukeSped
SentinelOne VS DearCry Ransomware (Exploits Microsoft Hafnium Exchange Vulnerabilities) Protect Mode
YouTube Video
Related Resources
YouTube Video
SentinelOne PartnerOne - America's 2025
⛳️ Last week in Pebble Beach the America's best cybersecurity partners came together for our annual PartnerOne summit. Check out…
Watch Now
YouTube Video
Just a Sec: Cybersecurity Unfiltered—Fast, Frank, and From the Front Lines
Welcome to the first-ever Just A Sec, a no-holds-barred, quick-fire monthly livestream. It’s cybersecurity like you’ve never heard it before—unfiltered,…
Watch Now
YouTube Video
LABScon24 Replay | A Walking Red Flag (With Yellow Stars) | Cary & Benincasa
China's cybersecurity competition ecosystem has grown significantly since 2017, with over 150 unique events and more than 400 total competitions.…
Watch Now
YouTube Video
LABScon24 Replay | Kryptina RaaS: From Unsellable Cast-off to Enterprise Ransomware | Jim Walter
Kryptina RaaS, originally a free giveaway, has evolved into a tool for large ransomware groups targeting Linux and cloud environments.…
Watch Now
Experience the World’s Most Advanced Cybersecurity Platform
See how our intelligent, autonomous cybersecurity platform harnesses the power of data and AI to protect your organization now and into the future.