2025年2月勒索软件流行态势分析

勒索软件流行态势分析三六零数字安全科技集团|高级威胁研究分析中心勒索软件传播至今，360大。36036020252AnubisRunSomeWares，前者具Clop（CraftCMSCVE-2025-23209PaloAltoNetworksPAN-OSCVE-2025-0111）2335以下是本月值得关注的部分热点：SimpleHelpRMMSliverCISAFBIGhost70NailaoLocker360，360(CCTGA）发布本报告。感染数据分析针对本月勒索软件受害者设备所中病毒家族进行统计：Weaxor家族占比24.42%居首位，第二的是RNTC占比16.28%的，Makop家族以15.12%位居第三。图1.2025年2月勒索软件家族占比对本月受害者所使用的操作系统进行统计，位居前三的是：Windows10、WindowsServer2008WindowsServer2016。图2.2025年2月勒索软件入侵操作系统占比20252PC，NASSMB图3.2025年2月勒索软件入侵操作系统类型占比勒索软件热点事件黑客利用SimpleHelpRMM漏洞部署Sliver恶意软件SimpleHelpRMMCVE-2024-57726CVE-2024-57727CVE-2024-57728ArcticWolfAkira前没有足够的证据来进一步印证勒索攻击与漏洞利用的必然联系。SimpleHelpRMM授权的连接。已观察到的攻击事件中，攻击者连接到爱沙尼亚IP的服务器7180SimpleHelpRMMCrowdStrikeFalcon控制。“sqladminSliver（agent.exeCobaltStrikeCobaltStrikeSliverShellSliverC2受害机器中被启用了远程桌面协议（RDP）的备份功能。建立持久性链接后，攻击者通SimpleHelpRMM客户端破坏域控制器（DC）并创建另一个管理员帐户svchost.exeCloudflareTunnel防火墙。CISA和FBI表示Ghost勒索软件入侵了70个国家或地区的组织美国网络安全与基础设施安全局（CISA）和联邦调查局（FBI）Ghost70中小企业。CISAFBI（MS-ISAC在周三发布的联合公告中称202170家的组织受到侵害。”GhostGhost、Cring、Crypt3r、Phantom、Strike、Hello、Wickrme、HsHaradaRapture，其攻击中使用的勒索软件Cring.exe、Ghost.exe、ElysiumO.exeLocker.exe。服务器中的安全漏洞。他们瞄准的是Fortinet（CVE-2018-13379、ColdFusion（CVE-2010-2861、CVE-2009-3960）和Exchange（CVE-2021-34473、CVE-2021-34523、CVE-2021-31207）中未修复的漏洞。新的NailaoLocker勒索软件被用于攻击欧盟的医保组织2024610NailaoLocker”勒索软件。此次攻击利用了CheckPoint安全网关的一个漏洞（CVE-2024-24919）来入侵目标网络，并部署了“ShadowPad”和“PlugX”恶意软件。OrangeNailaoLocker”调试和逃避沙盒检测的机制，也不会扫描网络共享。该恶意软件通过动态链接库加载（sensapi.dll）的方式部署到目标系统上，并利用了一个合法且经过签名的可执行文件（usysdiag.exe）进行掩护。恶意软件加载器（NailaoLoader）通过进行内存地址检查来验证环境，然后解密主有效负载（usysdiag.exe.dat）并将其加载到内存中。接着，NailaoLocker使用AES-256-CTR加密方案对文件进行加密，在加密后的文件后面添加“.locked”扩展名。加密完成后，勒索软件会留下一个HTML格式的勒索通知，文件名异常长，为：unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please.htmlOrange进一步调查后表示该勒索软件可能与KodexSoftwares（前身为EvilExtractor）的网络犯罪组织出售的勒索软件有相似之处，但并没有直接证据。黑客信息披露以下是本月收集到的黑客邮箱信息：rudolfbrendlinkof1982@evilant.ransomware@coomingproject@brendangirhin@proton.mebarboza40@spiderparadise@proton.meFilesupport@airmail.ccLinersmik@bettercallarmin1@insomrans@Jinnyg@germanmax26@zimmer1488@proton.meYourencrypt@vgod@ro.rupzimmer1488@Files4463@tuta.iohaxcn@proton.mezimmer1488@2mail.coRestorFile@Kryptran@evilcorp_simulation@Vfemacry@mail-on.usKrypt@innokentiy@Bitmine8@secretuser@tuta.ioinnokentiy@Barboza40@secretuser@password2@linersmik@paul_letterman@zohomailcloud.caattack-tw1337@proton.mejinnyg@thomas_went@pwn3d@keemail.mepoluz@wehavesolution@coronaviryz@RestoreFile@nsolution247days@korona@oken@systemfail@coronavirus@exploit.imvfemacry@mail-on.usnfortisram@zohomail.eucorecrypt@d3336666@johncollinsy@proton.mevijurytos@tuta.iomatrix9643@robertokarlosonewtggg@vijurytos@redtablet9643@Ghost_Kir4@proton.messpdlk00036@cock.libluetablet9643@adver@taylorpaycrypto@decodedecode@yandex.ruanjelikaa733@taylorbtcpay@decodedecode@gretikola@bitcoin@2mail.coaskhelp@hfghrebjr88@proton.me表1.黑客邮箱（。图4.2025年2月通过数据泄露获利的勒索软件家族占比以下是本月被双重勒索软件家族攻击的企业或个人。若未发现被数据存在泄露风险的企业或个人也请第一时间自查，做好数据已被泄露准备，采取补救措施。本月总共有962个组织/企业遭遇勒索攻击，其中包含中国11个组织/企业在本月遭遇了双重勒索/多重勒索。其中有11个组织/企业未被标明，因此不在以下表格中。HANSONFASO.COMWakefield&AssociatesHANSONCOLDSTORAGE.COMPrimeTrustFHALGAND.COMEngineeringMechanicsGARANMANUFACTURINGHammondTrucking&ExcavationInversionesClinicaDelMetaSAGARDNERHEALTHSERVICES.ORGRogersctpomdGALATECHNOLOGY.CO.UKI.B.GSPAHoustonSymphonyGREATPLAINSDISTRIBUTORS.COMGULFSTATESCS.COMWisperReimerIngenieureGmbHFORTFORWARDING.COMGTIMPORTS.NETUnimicronGSMETALL.COMLogixCorporateSolutionsMetaE2FNavien,Inc.soletechnologyPraxisEinsFOODIMPORTGROUP.COMTMCCMCOLDSTORES.COMCODAGAMI.COMFINLEYBEER.COMGOURMETTRADING.NETFFL-GROUP.COMTheChildren'sCenterOfHamdenGNSWORLD.COMFERNGROUP.COMOldNationalEventsPlazaGIBSONHOMEWARES.COMFAUSTDISTRIBUTING.COMGHENT.COMEMETER.COMGETGARVEYS.COMEMDOMAIN4.LOCALGERSONANDGERSON.COMEARLE.LOCALGBBEV.COMEXPORTPACKERS.COMGATE7LLC.COMEQLOGISTICS.USEKONOM.COMGAIAM.COMEZUP.COMEDITEL.EUFASHION.PRIEXCELLED.COMDERRYTRANSPORT.COMFLORENCECORPORATION.COMESSEXPOWERLINES.CADANA-CO.COMFUN-WORLD.NETESBERBEVERAGE.COMDESIGNDESIGNINC.COMFOTE.COMENTERATEK.MXDAATAGROUP.COMFORDSTORAGE.COMENCHANTEACCESSORIES.COMDUNNRITEPRODUCTS.COMLeeEnterprisesTHERMOTRAFFIC.COMD2GO.IOMercuryPaperIncUNITEDLEGWEAR.COMDYNASTYFOOTWEAR.COMPHONONET.DEDXC.COMDZLDUNDASJAFINE.COMDonnaG.Rogers,CPA,P.A.AdvantageHomeConstructionInsuranceDREXEL.CAThaiMetalAluminiumCo.,LtdCronosEuropaDONLEN.COMF&VCapitalManagement,LLC(FVCM)ThorntonEngineeringAustraliaPtyLtdDLFNA.COMGilbertdenbyco.co.ukDIRECTEX.NETSterlingBMWMetroSupplyChainGroup.DIAZFOODS.COMDETECNO.COMAutohausKießlingPlanetOneDELTAENTERPRISE.COMSocosystemsJohnson'sNurseryDELTACHILDREN.COMBiogenaGmbH&CoKGGoldsteinLawGroup,S.C.DECRESCENTE.COMOneDealerNorthernManagementDBETANCES.COMFinckCigarTheNorthwesternIllinoisAssociationDATAPAKSERVICES.COMCOGLANS.COM$1BUSA868GB<1%DISCLOSEDBayteqCYCLE.LOCAL$421.9MUSA1TB<1%DISCLOSEDWDNACASSINFO.COM3cBSINaphixCLAW.LOCALDigitalTechnologyCo.,Ltd.CGDC.COTTONG.LOCALShaghalniCPS.K12.IL.USGitlabs:SynelixisSolutions,INGV,VMOHoldingsBluAgentTechnologies,IncCONBRACO.COMStoryEnvironmentalNoviCommunitySchoolDistrictCLEARON.COMMullerInsuranceG&MDirectHireCRESTMILLS.COMNationzTechnologiesICRANEBSU.COMAfaSystemsLtd.COVECTRA.COMKendallAutoGroupSPEEDCoCONNEXION-INFORMATIQUE.FRwww.obrienavocats.qc.caCCOOServiciosCOMPASSHEALTHBRANDS.COMwww.cmsg.clAlBawaniCOLLECTIONXIIX.COMTristramEuropeanCOGHLANS.COMMartinEnergyGroupServicesCODAGAMI.COMChimuAgropecuariaS.A.G&SElectricLLCCMCOLDSTORES.COMOmniUnitedBentonPoliceDepartmentCLASSICACCESSORIES.COMSoundIdeasPeterGlennSkiSportCINEMA1.CAExcelSecurityCHEROKEEDISTRIBUTING.COMITUAbsorbTCHEMSTARCORP.COMSurface678CHALLENGER.COMFairhavenShipyardCCESARCASTILLO.COM$104.5MUSA994GB<1%DISCLOSEDCEDARSFOODS.COMLondonBelgraviaVvfIlinoisServicesCATHAYHOME.COMNationalLegalServiceSiegelGroupCATCHUPLOGISTICS.COMRooksRiderSolicitors(kc2)CASTLEWOODAPPAREL.COMArcandcoCARLSONDISTRIBUTING.COMGeneaEnfinConvertSolarD-7RRecievershipSpecialistsRadcoI.phIslandRAllen&PinnixFirstFederalSavings&LAtlasCommoditiesBenjaminConsultingServicesLuminusManagementThePawnGroupeRenaultInsystGmbHAdlerShineLLPALCOTTHRGROUPSimonMedImagingVermeerMexicoParatusPADAviationTechnicsGmbHFriendshipHouseBarhite&HolzingerInc.SerenitySalon&SpaMichael’sHairBodyMindl.warsemann.frGreenwichMedicalSpaBrockwayHairDesign.ecTrueWorldFoodsCrossroadsTradingCompany,IncMEDESCCapitalCellGlobal(CCG)palauhealthASRAMMedicalCollegeandHospitaMerkantiBankL$163MUSA455GB<1%DISCLOSEDPolstermöbelOelsaGmbH.idgilcar.coMarshallMotorHoldingsMNJTechnologiesDirectMedicalFileAlbrightInstituteMundeleinPark&RecreationDistrictWhoHireSouthGeorgiaAccountingSUpstateGlassTemperingDinizuluLawGroupLTDSaiedM.brAndoverFamilyMedicineCAPITALFINEMEATS.COM.mxNebraskaIrrigationCALIFORNIARAINLA.COMPPSServicesGroupMacJeeCAINEWAREHOUSING.COMossc.mxWBARCOMADE.COMBEINOGLOU.GRPulmonaryPhysiciansofSouthFloridaClinics|Datasecuritybreach!MinarisMedicalAmericaBIAGIBROS.COMNichinoRyokkaCoLBSIEDI.COMPoundRoadMedicalCentreAccess2JobsBOZICKDIST.COMSummitHomeHealth,INC.BOWANDARROWPET.COMComercializadoraS&EPerúBergEngineeringConsultants,Ltd.BOSSCHAIR.COMFirstDefenseFireProtectionBISSELL.COM(CLEO)M-1TOOLWORKSBESTBRANDSINC.COMExecutiveAgendaBERKSHIREINC.COMBirdsallMullerLLCBENSONMILLS.COMLigentiaBENBECKER.EUXepaSoulSupremeAdministrativeCourtofBulgariaBAYSIDENH.COMEMSON.COMOndunovaBARRETTDISTRIBUTION.COM$259MItaly440GB<1%DISCLOSEDSüdkabelGmbHBACKYARDDISCOVERY.COM$253.5MCanada3.6TB<1%DISCLOSEDALEGACY.COMAURORAIMPORTING.COMfoyernotredamedepaix.beARLAN.NLARKIEJIGS.COMstuermer-maschinen.deHochschuleAPOLLOCORP.COMVISEOAOL.COMAJMISSERTINCVectorEngineering,IncANNABELLECANDY.COMHallLawGroupLLPANDROSNA.COMNextTIANDREWSDISTRIBUTING.COMAlabamaOphthalmologyAssociatesAMSINO.COMDR.ClaimsFLLLCAMERICANLIGHTING.COM$190.5MUSA388GB<1%DISCLOSEDEzyLegalALPADVANTAGE.COMDBKALLTECH.COMAuroraBALLIANCEMERCANTILE.COMHeartlandHealthCentertraffic-advertising-llcAIRLIQUIDE.COMLaurensSchoolDistrict56dr-elizabeth-bjornsonAGILITYAUTOPARTS.COMWKKELLOGG.COMHagginOaksGolf()AFFINITYCANADA.COMWHEELS.COME.zmACTIAN.COMWERTEX.COMlake-washington-vascularACPIDEAS.COMWENDOVERART.COMh2o.aiACCEM.COMWELCOMEIND.COMBeniPlusABCOPRODUCTS.COMVANDALE.COMBrolly3PLSOFTWARE.COMVSSTRANSPORTATIONGROUP.COMRevi3FINITY.NETVSSLOGISTICS.COMHelpMeGrowYolo1888MILLS.COMVPGLOBAL.COMNimuSoftCXTSOFTWARE.COMVLCDISTRIBUTION.COMIsraelPoliceHackedVIKINGWEAR.COMKittycookiesVIDAGROUP.COMVERSANTTECHNOLOGIES.COM.myVERSAILLES-INC.COM$25.5MUSA659GB<1%DISCLOSEDwww.mgl.lawVALLEYDIST.COMHCRGCareGroupUNIEK.INTERNALUNIVERSALWAREHOUSES.COMLeadingEdgeSpecializedDentistryUSM-INC.COMiRidgeInc.UPPERLAKESFOODS.COMMaxvyTechnologiesPvtUNITERS.COMUniversitateaPolitehnicadinBucurestiTITESI.LOCALMakesworthAccountantsTILLSONBURGHYDRO.CADecore-AtiveSTWINSTARHOME.COMDanielsHomesSpectrumSolutionsTESISQUARE.COMPREMIERHOUSEWARESLIMITEDHTIMKEN.COMlavi.co.ilSubstituteTeacherServiceTWTDIST.COMSAKAISOUKENCo.TRIPLE8.CABuanderieCentraledeMontrealcmr24TUXTON.COMBushmans3SSTUCKERCO.COMFlignoTRIMACO.COMChalmerstekniskahögskolaTRIBORO.COMTRENDSPOTINC.COMHRS_IDEA_ExpertisesTropicalFoodsCompanyIncTPGXML.COMBulldogOilfieldSTOTALWINE.COMTHENORTHWEST.COMCunaSTHEMEZZSHOPPE.COMInlandEmpireDistributionSystems,Inc.SmithDunn&CoTERINICHOLS.COMWylieSteelF$17.4MCanada366GB<1%DISCLOSEDTARATOY.COMOxfordC$18.2MUSA95GB<1%DISCLOSEDTALLTAILSDOG.COMStage3SSAMSCLU.COMTSCHAWK.COMRheinischerSSJI.LOCALStartekPeglar&CalcagniUNIEKINC.COMSTAR.LOCALWeedManCanadaNG-BLUNetworksSCOPEIMPORTS.LOCALRobinsonFamilyDentistryPresenceFromInnovation(PFI)SDITECH.COMCragerLaBordeLexingtonElectricSUPPLYON.COMTheTownsleyLawFirmInformationRobertshawSEA-DELIGHT.CAdanecourt.kent.sch.ukHARADASUN-RICH.COMSmithDunn&CoSENAO.COM.TWDIEMSTUDIODESIGNS.COMTopSystemsSTILACOSMETICS.COMeConceptionsSTEVENSONBEERDISTRIBUTING.COMhamtonMcCORMICKTAYLORSTEPHENJOSEPHGIFTS.COMHisingstadsBleckSTELLARPACK.COMLeadershipSSTARMARKETINGCANADA.COMThongSiaDashBusinessSTANLEYCREATIONS.COM$22.5MUSA26GB<1%DISCLOSEDHallChadwickSPARTANLOGISTICS.COMAutoschadePippelNESCTCSecurityServicesSOBELATHOME.COMPedensiaGraphicsDistributionSTORKCRAFT.COMSLTRANS.COMWinbasShinsungDeltaTechSIMPLEHUMAN.COMLINTEC&LINNHOFFHoldingsBanfiVintnersSHIPGFS.COMSSGKINC.COMWoman'sAthleticClubofCSGEMESA.COMGreencastle-AntrimSeniorHighSchool()SEA-JET.COMAlliedTenesisRuralHealthServicesSAUNDERSMIDWEST.COMBulverdeGlass,Inc.Mid-StateMachine&FabricatingCorpSATCO.COMP.N.SakkoulasTSANTAFENYSHOP.COMDACapitalA2SALTEDAWG.COMCOSMEDSALSON.COMPersanteHealthCSAKAR.COMREVITALASH.COMPREDCLAYGOURMET.COMQBROYALLEMKES.NLAcquadevelopmentTownCounselLaw&LitigationROUNDHOUSEGROUP.COMGProfessionalComputerCo.,Ltd.REV.DEMLUACoffeeREMAFOODS.COMRealtime.twGFZHelmholtzCentreforGeosciencesREGENCY-RIB.COM/PT.ITPRENEURINDONESIATECHNOLOGYREESEPHARMACEUTICAL.COMDevlionREESECHEMICAL.COMSOLEILREDDYICE.COMhemio.deRDSGAMING.COMMadiaRAYTIK.COMwww.naga.aeX-labgroupRANDSTRUCKING.COMBolinCentreforClimateResearchRADLEY.COMRACKSPACE.COM.brQBTRANSPORTATION.COMCityofMcKPTIDOM.LOCALFortuneElectricCoLtdemin.clPUROLATORINTERNATIONAL.COMNortheastDeltaHumanServicesAPTCOUPLING.COMPRIMELINE.NET(M)EPRESPERSE.COMHeritageSouthCreditU.brPITSCO.COMCastleRockConstructionCPIPERSYSTEMS.COMWindowWorldofRPHYSICALDISTRIBUTIONSERVICES.COMHydronic&SteamEPETMATE.COMRPERRONEANDSONS.COMCSTCPEMAMERICA.COMF.TECHR&DNORTHAMERICAINC.PELLONPROJECTS.COMPPDSITE.COMNelson&Townsend,CPA'PARTNER.ROG.coPANEUROFOODS.COMPAIGEDENIM.COMPAIGE.COMGoStrictlyelitt-sas.frPACIFIC-TEXTILE.COMBethanyLutheranCOUTSOURCELOGISTICS.COMGANROOBJECTIF-EMBALLAGES.FRRegencyMOREGONFRUIT.COMTheAOUTERSTUFF.COMShieldsFacilitiesM.arONWBEER.COMADULLACT.ecOLDSPRODUCTS.COMA.mtOFFICEBASICS.COMOmydoosportadmin.seO2COOL.COMAspireRuralHealthSystemC&RMoldsIncNEBRASKAWAREHOUSE.LOCAL-ROTORSIM-CAECommercialSolutionsNRESPONSE.COMMozoGrau()NORTHWIRE.COMCoMo-IndustrialEngineeringNYCALLIANCE.COMcapstoneins.caNPLUS1TECHNOLOGIES.COMNMR.CO.UKNashBrothersCNETPLUSTMS.COMNipponSteelUSANATURESWEET.COMFinancialServicesofAmerica,Inc.MAPLELEAFFARMS.COMLayfield&BorelCPA'sL.L.CMAGTARSALES.CADain,Torpy,LeRay,Wiest&Garner,P.C.MDS.LOCALITSSMMSUPPLY.COMEliteAdvancedLaserCorporationC2STechnologiesInc.MCCUBBIN.COMDanEckmanCPASSMCMAE.LOCALRiversCasinoandRushStreetGamingMCWILLIAMSMOVING.COMAsterraPropertiesMYSTICAPPAREL.COMCalienteConstructionMAINFREIGHT.COMMAHARTOOL.COMObexMMERCERLOGISTICS.COMCacheValleyENTMETALANDWIRE.COMJPExpressDickerson&NiemanRealtorsMUXIE.COMCentralDistrictHealthDepartmentSheridanNurseriesMUNDI.COMMORRISGROUP.COTheHillBrushMORET.COMWoodwayUSAMONARCHBRANDS.COMThermaSealInsulationSystemsDanielIslandClubMGAINNOVATION.COMQualityHomeHealthCareKWSMGAE.COMVickyFoodsDPCDevelopmentMETOOSHOES.COMSqueezer-softwareQGSDevelopmentMERIDIANGROUPREM.COMSpacemanicgruppozaccaria.itMERANGUE.COMINGVGlowMediSpaMEGATOYS.COMGrailSpringsRetreatMEDCODATA.COMKaradenizHolding()MCARDLESKEATH.COMLakeshoreTitleAgencyMARELLI.COMDentonRegionalSuicidePreventionCoalitionMAJORLABELGROUP.COMLOLLYTOGS.COMLAWSONROANOKE.COMLYNNS.COMGOV(VIRTUALIT)LOSCABOSMEXICANFOODS.COM.mxLOSCAB.COMPonte16Hotel&CasinoLNFDISTRIBUTORS.COMAlfordWaldenLawLITTLEARTH.COMPascoSystemsLENMAX.COMMPPGroupofCompaniesLEGALTRACKER.COMHess(hess-gmbh.de)ELEADINGLADY.COMTJKMDRITitle&EscrowLAPOLICEGEAR.COMaskgs.maDPAAuctionsKEELEWL.COMAltairTravelKWIKGOAL.COMweathersa.co.zaCivilDesign,IncKURTADLER.COMErieManagementGroup,LLCTheGatesworthSeniorLivingSt.LouisKOLCRAFT.COMKOCHLOGISTICS.COMHeartcentreTosafKNFILTERS.COMNorthAmericanSKIRCHNERBEER.COMEACConsultingFourEyeClinicsKIKKERLAND.COMMICROMANUFACTRINGKEELEWAREHOUSING.COMColdStorageManufacturingturbompJDADELIVERS.COMTheBrown&HurleyGroupCyriousSoftwareJPWEST.COMSocietateaEnergeticaElectricaS.A.MedicalAssociatesofBrevardJOHNPAULRICHARD.COMTieDownEngineeringCivicCommitteeJOBAR.COMMonroeTransportationServicesInc