Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks

  /     /     /  
Publicated : 23/11/2024   Category : security


Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks


The ransomware is rudimentary with basic functionalities, likely having been created by an inexperienced developer — but its effective at locking up files and sucking up memory capacity.



A ransomware strain coined ShadowRoot has been found targeting Turkish businesses through
phishing attacks
.
The phishing emails contain a PDF attachment disguised as an invoice with embedded malicious links. Upon user interaction, this triggers a download of a RootDesign.exe file hosted on a compromised GitHub account.
The downloaded file is a Delphi binary and, according to researchers at Forcepoint who analyzed the exe, it drops further payloads: C:TheDreamRootDesign.exe, C:TheDreamUninstall.exe” and “C:TheDreamUninstall.ini.
We have observed recursive self-process creation by RootDesign.exe, which causes the files to get encrypted multiple times, resulting in higher memory consumption,
the researchers said
. It also drops many copies of encrypted files on the root.
They add that the ransomware appears rudimentary and likely the work belonging to an inexperienced developer.
In addition to user awareness for defense, the researchers recommend blocking the following email addresses to prevent being targeted by the Shadowroot threat actors:
Kurumsal[.]tasilat[@]internet[.]ru
ran_master_som[@]proton[.]me
lasmuruk[@]mailfence[.]com

Last News

▸ Making use of a homemade Android army ◂
Discovered: 23/12/2024
Category: security

▸ CryptoWall is more widespread but less lucrative than CryptoLocker. ◂
Discovered: 23/12/2024
Category: security

▸ Feds probe cyber breaches at JPMorgan, other banks. ◂
Discovered: 23/12/2024
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks