Thanos Ransomware Attacks Now Disable Backups, Avoid Detection, and Impersonate the OS



thanos ransomware attackRecent updates to the well-known Ransomware-as-a-Service – including the addition of RIPlace – make Thanos a formidable challenge for even well-secured organizations.

I’ve said it before and I’ll say it again: the bad guys operate just like the good guys. Cybercriminal organizations are just businesses with an evil go-to-market plan. And as such, they evolve and improve their software to have better features, to improve performance, and to produce a consistent and predictable result.

Recent developments to Thanos documented by security researchers at Sentinel Labs demonstrate this point exactly. Some of the improvements to Thanos include:

  • RIPlace technique for avoiding detection
  • Encryption speed enhancements
  • Disabling of 3rd party backup solutions
  • Ability to impersonate Windows SYSTEM via process hollowing
  • FTP-based reporting

And this is just a fraction of the improvements seen in Thanos over the last 3 months!

Organizations need to realize ransomware (in general) isn’t just encryption software; Thanos demonstrates the effort put into ensuring each step of an attack – from delivery, to installation, to lateral movement, to encryption – is successful. Add to this the fact that Thanos is Ransomware-as-a-Service – it’s available to any person that wants to start their own Ransomware “business”, multiplying the frequency and distribution of this malware.

From the looks of the improvements, once it’s installed, it’s going to see plenty of successes. So, organizations need to take steps to stop it before it starts; and that begins with the user not engaging with phishing emails. And that requires continual Security Awareness Training to both teach and reinforce the need to always be mindful about suspicious content when interacting with email and the web.


Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 24 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 25 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews