Hello, welcome to the Monday, October 14th, 2019 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich.

I'm recording from Chicago, Illinois. Federal holiday today in the United States, so I'll keep today's podcast a little bit shorter.

For all the friends of Yara, we do have a new version. This version makes the XOR modifier a little bit more flexible and also adds private

strings. If you're not familiar with Yara, you're essentially a language to describe binaries and patterns.

So it's often used in open source antivirus and matter detection engines.

Now these days we keep hearing about antivirus companies releasing decryption tools for various ransomware

strains. There's a new twist to this that sort of was released on Friday. Web developer in

Germany, Tupias Fremel, was infected with ransomware that hit his QNAP network accessible storage device.

And after he actually paid for the ransomware, he discovered that one of the web server that the ransomware was communicating with had an open web shell installed.

So he used this web shell to essentially compromise that server

further and exfiltrate any keys stored in the server's database for different victims of this ransomware.

He made these keys public, so if you were recently infected by the

Mystic Ransomware, you may want to take a look at the list and see if it helps you decrypt

your data. Of course, this kind of hacking back is always quite controversial. According to the description, I read,

I think he did sort of the minimum amount of hacking, so to speak, in order to get the data

back for other victims of this criminal. So I would call his response to be proportional.

On the other hand, these web servers that were used by the ransomware were third-party

web servers that were compromised by the ransomware.

So that's always the risk here that if you overstep your boundaries, you're actually doing

additional damage to victims of other attacks.

And Malware Hunter team came across an interesting cryptocurrency trading platform, or at least

that's what it claimed to contain, that did include additional goodies in the form of info stealing malware.

...