LockBit ransomware virus attacks Windows Domain servers in Vietnam

LockBit Black (version 3.0), a new variant of the globally infamous data encryption virus, began its attacks in Vietnam in early 2024.

The LockBit malware is more sophisticated, both in its encryption script and in the way it spreads.

In the past 2 months, Bkav experts have continuously received requests for help from many businesses in Vietnam with the common situation that computers in the internal network were all encrypted at the same time, and the data could not be saved.

Experts from Bkav Security Group said that the malware has made many more sophisticated improvements, both in terms of encryption scenarios and spreading methods, and is capable of bypassing conventional security solutions.

Investigation and analysis results from many cases show that the culprit of data encryption is LockBit 3.0, also known as LockBit Black, a ransomware of a famous hacker gang, recently destroyed by the International Police Alliance (including the UK's National Crime Agency - NCA, the US Federal Bureau of Investigation - FBI and the European Union Police Agency - Europol).

LockBit Black has more sophisticated improvements than previous variants. They are specifically designed to target Windows Domain management servers in the internal system. After infiltrating, the virus uses these servers to continue spreading to the entire system, disabling security solutions (disable anti-virus, firewall), copying and executing malicious code... In this way, the virus can encrypt all machines in the internal system at the same time without having to attack each machine as before.

To avoid being attacked by LockBit as well as other data encryption viruses, Bkav experts recommend that users and system administrators: Regularly back up important data. Do not open internal service ports to the Internet when not necessary. Evaluate the security of services before opening them to the Internet and install strong enough anti-virus software for constant protection.

KIM THANH

Source: https://www.sggp.org.vn/virus-ma-hoa-tong-tien-lockbit-tan-cong-cac-may-chu-windows-domain-tai-viet-nam-post729694.html