New Matrix Ransomware Variants Installed Via Hacked Remote Desktop Services

[Faybert]

Content source

https://www.bleepingcomputer.com/news/security/new-matrix-ransomware-variants-installed-via-hacked-remote-desktop-services/

Two new Matrix Ransomware variants were discovered this week by MalwareHunterTeam that are being installed through hacked Remote Desktop services. While both of these variants encrypt your computer's files, one is a bit more advanced with more debugging messages and the use of cipher to wipe free space.

Based on the debugging messages displayed by the ransomware when it is executed and the variousreports in the BleepingComputer forums, this ransomware is currently being distributed to victims by the attackers hacking into Remote Desktop services connected directly to the Internet. Once the attackers gain access to a computer, they upload the installer and execute it.

Two different variants being distributed
Currently there are two different Matrix variants being distributed at this time. Both variants are being installed over hacked RDP, encrypt unmapped network shares, display status windows while encrypting, clear shadow volume copies, and encrypt the filenames. There are, though, some slight differences between the two variants, with the second one ([RestorFile@tutanota.com]) being a bit more advanced.
.....
.....

How to protect yourself from the Matrix Ransomware
In order to protect yourself from ransomware in general, it is important that you use good computing habits and security software. First and foremost, you should always have a reliable and tested backup of your data that can be restored in the case of an emergency, such as a ransomware attack.

As the Matrix Ransomware may be installed via hacked Remote Desktop services, it is very important to make sure its locked down correctly. This includes making sure that no computers running remote desktop services are connected directly to the Internet. Instead place computers running remote desktop behind VPNs so that they are only accessible to those who have VPN accounts on your network.

It is also important to setup proper account lockout policies so that it makes it difficult for accounts to be brute forced over Remote Desktop Services.
........
........