Home » Uncategorized » Sophos alerts businesses about new ransomware called MegaCortex
John Shier

Sophos alerts businesses about new ransomware called MegaCortex



Sophos, a global leader in endpoint and network security, has released alert about a new ransomware that is threatening businesses.

On Friday, May 3, 2019, at 3:45 pm ET, SophosLabs Uncut released detailed malware analysis of the new ransomware called MegaCortex

Sophos research team expatiating on the ransomeware writes:

“MegaCortex was a relatively little-seen malware that suddenly spiked in volume on May 1. Sophos has seen MegaCortex detections in the US, Canada, Argentina, Italy, the Netherlands, France, Ireland, Hong Kong, Indonesia, and Australia.

“The ransomware has manual components similar to Ryuk and BitPaymer, but the adversaries behind MegaCortex use more automated tools to carry out the attack – this is unique.

“Up until now, Sophos has seen automated attacks, manual attacks and blended attacks, which typically lean more towards using manual hacking techniques to move laterally; with MegaCortex, Sophos is seeing heavier use of automation coupled with the manual component.

“This new formula is designed to spread the infection to more victims, more quickly.

As indicated in the SophosLabs Uncut article, MegaCortex Ransomware Wants to be TheOne, there is no explicit value for the ransom demand in the ransom note.

The attackers invite victims to email them on either of two free mail.com email addresses and send along a file that the ransomware drops on the victim’s hard drive to request decryption “services.” 

The ransom note also promises the cybercriminals “will include a guarantee that your company will never be inconvenienced by us,” if the victims pay the ransom, and continues, “You will also receive a consultation on how to improve your companies cyber security.”

READ ALSO  NCC Holds ‘Stakeholders Forum On National Roaming And Active Infrastructure Sharing’

Sophos has also made the following protection recommendation to businesses:

“It appears that there’s a strong correlation between the presence of MegaCortex, and a pre-existing, ongoing infection on the victims’ networks with both Emotet and Qbot. If IT managers are seeing alerts about Emotet or Qbot infections, those should take a high priority. Both of those bots can be used to distribute other malware, and it’s possible that’s how the MegaCortex infections got their start.

“Sophos has not seen any indication so far that Remote Desktop Protocol (RDP) has been abused to break into networks, but we know that holes in enterprise firewalls that allow people to connect to RDP remain relatively common. We strongly discourage this practice and suggest that any IT admin who wishes to do this put the RDP machine behind a VPN

“As the attack seems to indicate that an administrative password was abused by the criminals, we also recommend the widespread adoption of two-factor authentication wherever possible

“Keeping regular backups of your most important and current data on an offline storage device is the best way to avoid having to pay a ransom 

“Use anti-ransomware protection, such as Sophos Intercept X, to block MegaCortex and future ransomware

Commenting on the study, Sophos Senior Security Advisor John Shier, said:

“We suspect this is your script kiddie/living-off-the-land ‘mega bundle’ and a good example of what we’ve lately been calling cybercriminal pen-testing.

“The MegaCortex attackers have taken the blended threat approach and turned it up to 11, by increasing the automated component to target more victims. Once they have your admin credentials, there’s no stopping them. Launching the attack from your own domain controller is a great way for the attackers to inherit all the authority they need to impact everything in an organization.

READ ALSO  ntel 4G/LTE Network Now Live In Port Harcourt

“Organizations need to pay attention to basic security controls and perform security assessments, before the criminals do, to prevent attackers like these from slipping through”. 

Leave a Reply

Your email address will not be published. Required fields are marked *



Check Also

#Endsars: Twitter Erupts as Gov Sanwo-Olu Declares 24 hour Curfew, says hoodlums disturb peaceful protests

Babajide Sanwo-Olu Executive Governor, @jidesanwoolu has ...

Nigeria’s Democracy is Taking Giant Strides: The Ondo State Governorship Election – Held 10 October, 2020

Members of The Development Initiative, TDI ...

ncc New ITR danbatta

How 7 SIM offenders land behind bars – NCC

NCC says its commitment to stop ...


CWG’s Billsnpay platform gains traction during Covid-19 lockdown

BillsnPay excellent support model offers the ...

NITRA Innovative Forum 2020 ncc nitra

NCC, Digital Encode Support NITRA Innovative Tech Forum On Post-COVID-19 Strategies

NCC and Digital Encode have throw ...