New Ransomware, OldGremlin, Coming Soon to an Organization Near You!

ransomware oldgremlinPay attention to this one. Despite only targeting Russian companies, the use of custom self-made malware and decidedly creative phishing campaigns makes them a potential danger.

OldGremlin first showed in in late March of this year. Singapore-based GroupIB took note and has been tracking them continually.

What makes this new kid on the block so interesting is found in the malware and social engineering they use. According to Group-IB:

  • Their backdoors are custom, dubbed TinyPosh and TinyNode
  • As is their ransomware, dubbed TinyCrypt
  • They are using third-party software for reconnaissance, lateral movement, taking screenshots, and email password recovery
  • They impersonate well-known individuals
  • Their phishing gambits are unique; one example was that of a journalist wanting to setup an interview. Once scheduled, the second email (the malicious one) included a link to the questions.

Their demonstrated expertise in social engineering tells me that you’re going to need to improve your user’s ability to spot a suspicious email a mile away. Security Awareness Training provides the education needed – both practically speaking with examples of attack, but also strategically, teaching the user about the need to be vigilant as part of the organization’s overall security posture.

To date, this Russia-based ransomware group has only targeted prominent Russian companies, but their methods show real promise. Once they get their hands on someone that speaks and can write in other languages, it’s a safe bet you’ll see them showing up in your neck of the woods.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews