11-19-2020 , 07:27 AM
https://www.bleepingcomputer.com/news/se...som-notes/ Egregor ransomware bombards victims' printers with ransom notes
By Lawrence Abrams
November 18, 2020 05:25 PM The Egregor ransomware uses a novel approach to get a victim's attention after an attack - shoot ransom notes from all available printers.
Ransomware gangs know that many businesses would rather hide a ransomware attack than make it public, including to employees, for fear of the news affecting stock prices and their reputation.
To increase public awareness of the attack and pressure a victim into paying, the Egregor operation is known to repeatedly print ransom notes from all available network and local printers after an attack.
While BleepingComputer has been aware of this tactic, it wasn't until last weekend after Egregor's attack on retail giant Cencosud that we saw it in action.
El #ransomware que le pegó a Cencosud es #Egregor. La ransom note empezó a salir en las impresoras de varios locales de Argentina y Chile pic.twitter.com/k1Ps4IDUyq
— Irlenys (@Irlenys) November 15, 2020
As you can see from a closeup of the printout, this is the same ransom note created on computers being printed to a receipt printer. BleepingComputer can confirm that it is not the ransomware executable performing the printing of ransom notes.
Instead, it is believed that the ransomware attackers utilize a script at the end of an attack to print out ransom notes to all available printers.
This script has not been found as of yet.
By Lawrence Abrams
November 18, 2020 05:25 PM The Egregor ransomware uses a novel approach to get a victim's attention after an attack - shoot ransom notes from all available printers.
Ransomware gangs know that many businesses would rather hide a ransomware attack than make it public, including to employees, for fear of the news affecting stock prices and their reputation.
To increase public awareness of the attack and pressure a victim into paying, the Egregor operation is known to repeatedly print ransom notes from all available network and local printers after an attack.
While BleepingComputer has been aware of this tactic, it wasn't until last weekend after Egregor's attack on retail giant Cencosud that we saw it in action.
El #ransomware que le pegó a Cencosud es #Egregor. La ransom note empezó a salir en las impresoras de varios locales de Argentina y Chile pic.twitter.com/k1Ps4IDUyq
— Irlenys (@Irlenys) November 15, 2020
As you can see from a closeup of the printout, this is the same ransom note created on computers being printed to a receipt printer. BleepingComputer can confirm that it is not the ransomware executable performing the printing of ransom notes.
Instead, it is believed that the ransomware attackers utilize a script at the end of an attack to print out ransom notes to all available printers.
This script has not been found as of yet.