Malware News GIBON Ransomware Being Distributued by Malspam

[LASER_oneXM]

A new ransomware was discovered by ProofPoint researcher Matthew Mesa called GIBON. This ransomware is currently being distributed via malspam with an attached malicious document, which contain macros that will download and install the ransomware on a computer. Unfortunately, more information about the malspam is currently not available at this time.

We have, though, provided information below on how the ransomware operates and according to Michael Gillespie it does appear to be decryptable. So if you are a victim, please contact us in our GIBON Ransomware Support & Help topic and we will see what we can do.

Why is it called GIBON Ransomware?
When a new ransomware is discovered it is not always easy to come up with a good name for it. Sometimes researchers will use strings found in the executables and other times the malware itself will give us clues as to what we should call it.

At this time, it is not currently known how much ransomware the developers are demanding. As previously stated, the good news is that this ransomware appears to be decryptable, so be sure to post in our support topic if you become infected with it.

How to protect yourself from the GIBON Ransomware
In order to protect yourself from GIBON, or from any ransomware, it is important that you use good computing habits and security software. First and foremost, you should always have a reliable and tested backup of your data that can be restored in the case of an emergency, such as a ransomware attack.

You should also have security software that contains behavioral detections such as Emsisoft Anti-Malware, Malwarebytes, or HitmanPro:Alert.

 

[Der.Reisende]

Thank you for the share @LASER_oneXM!
The ransomware has already been broken by @ Michael Gillespie, a free decrypter (.encrypt variant) is available for victims:
Michael Gillespie on Twitter

Direct Link to the decrypter: https://download.bleepingcomputer.com/demonslay335/GibonDecrypter.zip

 

[TechMech]

People should have been already taught about such viruses; and should by now know the risks, an email sent by a stranger is strange enough, so why even bother open a document through one? I honestly think that ICT books should include such tips about how to avoid such viruses; I'm not even talking about books for middle school, but at least for people that are about to graduate, since not everybody will go to computer science. The main idea basically is: Don't ever go to a website that you think is weird, download weird useless applications that you know you'll never even use from a non secure websites, do not even open emails from people you do not know. By the way antivirus' can't detect every virus so make sure you keep them updated and I usually take less than 5 minutes from my day to do a weekly manual virus check, this has also helped me diagnose missing drivers *i'm running on non-genuine since I was a rebel and didn't listen to my dad* also keep track of updates and uninstall useless applications knowing I do not use them; if you do not own a web antivirus then I strongly recommend using firefox, since it doesn't let you enter malicious websites (if you have it enabled)

 

[Prorootect]

People should have been already taught about such viruses; and should by now know the risks, an email sent by a stranger is strange enough, so why even bother open a document through one? I honestly think that ICT books should include such tips about how to avoid such viruses; I'm not even talking about books for middle school, but at least for people that are about to graduate, since not everybody will go to computer science. The main idea basically is: Don't ever go to a website that you think is weird, download weird useless applications that you know you'll never even use from a non secure websites, do not even open emails from people you do not know. By the way antivirus' can't detect every virus so make sure you keep them updated and I usually take less than 5 minutes from my day to do a weekly manual virus check, this has also helped me diagnose missing drivers *i'm running on non-genuine since I was a rebel and didn't listen to my dad* also keep track of updates and uninstall useless applications knowing I do not use them; if you do not own a web antivirus then I strongly recommend using firefox, since it doesn't let you enter malicious websites (if you have it enabled)

Agree fully with you, I'm on the lookout for constantly, if I open my PC (I'm closing it now, I close it now, so I become 100% secured)
And people here on MT is also well educated about web dangers, I hope!

 

[Solarquest]

GIBON Ransomware Being Sold on Underground Criminal Forums

 

[vemn]

Agree fully with you, I'm on the lookout for constantly, if I open my PC (I'm closing it now, I close it now, so I become 100% secured)
And people here on MT is also well educated about web dangers, I hope!

Through this forum we learn!