保护设备免受现代恶意软件威胁至关重要，尤其是在攻击者不断演变其攻击策略的情况下。勒索软件团伙现在将数据窃取、勒索和破坏性加密相结合，以最大限度地造成损害。最近的一个例子是名为 CCLand 的勒索软件，这种勒索软件旨在破坏运营、迫使受害者支付巨额赎金并窃取敏感信息。
一种隐蔽但后果严重的威胁
研究人员在调查活跃的网络威胁时发现了 CCLand。该恶意软件的行为与典型的勒索软件类似，但其运营者使用了额外的勒索手段，从而加剧了风险。一旦入侵系统，CCLand 就会加密存储的文件，并通过添加“.ccl”扩展名来更改文件名。例如，“1.png”文件会变成“1.png.ccl”，而“2.pdf”文件会变成“2.pdf.ccl”，使得用户在没有解密密钥的情况下完全无法访问这些文件。
在进行加密的同时，该恶意软件还会创建一个名为“RECOVER_README.txt”的勒索信息。该信息告知受害者，攻击者已入侵公司内部网络，并窃取了超过379GB的敏感数据。该信息声称，加密系统不得手动修复，并警告称，任何不当操作都可能造成不可逆转的损害。
利用恐惧和压力进行敲诈勒索
勒索信中概述了一种似曾相识却又咄咄逼人的敲诈勒索策略。根据信中内容，攻击者索要价值 5 万美元的比特币，以防止被盗信息被出售、泄露或发布到网上。他们通过 Session 和 Tox 提供沟通渠道，声称支付赎金后将删除数据并提供系统恢复协助。
此外，还设定了严格的最后期限。如果受害者不予回应，犯罪分子威胁将窃取的资料发布到多个泄露平台上。这种加密和数据窃取威胁相结合的方式旨在迫使受害者迅速就范。
为什么付费是个严重的错误
受害者往往会考虑付费，因为没有合适的解密工具，加密文件就无法使用。然而，向网络犯罪分子支付赎金既不可靠又风险极高。无法保证攻击者会提供有效的解密工具、归还被盗数据，或者不再进行勒索。
更安全的替代方案（如有）是使用干净的离线备份来恢复受影响的系统。恢复完成后，必须彻底清除恶意软件，以防止其重新加密文件或传播到其他系统。
常见感染途径
勒索软件运营者通常依靠欺骗手段在受害者设备上执行恶意代码。CCLand 也采用了这些手段，其中包括：
- 包含有害附件或链接、虚假技术支持信息或欺诈性通知的电子邮件
- 通过被入侵的网站、恶意广告、盗版软件或不安全的下载源传播的文件
攻击者还会将勒索软件捆绑在受感染的U盘、点对点网络以及ZIP或RAR等压缩文件中。恶意脚本、篡改的Office文档和伪装的可执行文件仍然是常见的传播途径。
加强网络防御
提升安全态势是降低勒索软件感染风险的最佳途径之一。用户和组织都能从积极主动的措施中获益，这些措施能大大增加入侵企图成功的难度。
能够显著提高保护水平的核心做法包括：
- 保持软件、操作系统和安全套件更新，以修复可被利用的漏洞
- 使用强密码和唯一密码，并结合多因素身份验证，以减少未经授权的访问。
最后想说的话
CCLand勒索软件揭示了网络犯罪分子如何将加密与数据窃取相结合，从而最大限度地对受害者造成伤害。虽然威胁十分严重，但良好的网络安全习惯和可靠的备份可以显著降低此类攻击造成的损失。精心构建并妥善防御的环境仍然是保护系统和数据免受勒索软件侵害的最有效策略。
System Messages
The following system messages may be associated with CCLand勒索软件:
Dearest - executive,
We are CCLand team. A 100% financially motivated group.
We have recently breached your intranet and took your 379GB+ confidential data , which will face huge amount GDPR fine when happend data leak
AND we have encrypted your data , don't do anything to your computer which may cause data loss forever.
But, don't worry. You can always save your data for payment. We do not seek political power or care about any business.
So, your only option to protect your business reputation is to discuss conditions and pay 50000$ usd value bitcoin to our address.
In case you refuse, you will lose all abovementioned data: some of it will be sold to the black actors, the rest will be published on our blog and shared on torrent trackers.
We always fulfil all promises and obligations.
Lower you see our contact ,using session id to add us:
0520b95c024ceb200c34c69100799e136e3453ff93ab30347dcc9a77edf7312b09
Session website is : hxxps://getsession.org/
And if you cannot contact us ,you can refer to our tox id instead:
28274EDFC647C08E6ED08BAF001F9A28CDD6C411CDC5A79ECC49AAF1A71ED671F9A3CE905C01
qTox download at : hxxps://qtox.github.io/
File preview: -
We are ready to give 3 non-essential file decryption for free.
We are also ready to continue discussing the next steps after you confirm that you are a legitimate representative of the company.
We are not interested in destroying your business. We want to take the money and you not hear from us again.
Time is ticking on clock and in few days if no payment we publish and close chat.
Please convey this information to your executive and managers as soon as possible.
After a successful transaction and receipt of payment we promise
1) technical advice
2) We will never publish you data
3) Everything we download will be delete w/proof
4) Nothing will ever disclose
Decide soon and recall that no response result in leakbase blog posting.IN A WEEK , DEADLINE IS 26/11/2025. Name is first and soon data after. We advice not reach point of no return.
Contact us in a day will give you a special offer which can end this deal quick and cheap, it will be a considerable price for both.
If you go on the contrary , we'll publish your data on darkforums.st like we did to selbyhardware and some other company: https://www.brinztech[.]com/breach-alerts/brinztech-alert-database-of-thinline-technologies-is-leaked/
The soon you contact us , the smaller the problem will be , we only ask for bitcoins for above services
We could give you a 15% discount if the deal can be reached in a week
Contact Us for more details , we can work out the solution together
YOUR ID:
Kindly Regards , CCLand
|
