RansomExx Infects Brazil's Superior Court of Justice

Threat Watch

Threat Watch RansomExx Infects Brazil’s Superior Court of Justice

RansomExx Infects Brazil’s Superior Court of Justice

Brazil’s Superior Court of Justice has announced an attack against the Superior Court of Justice’s (STJ) network Tuesday that is currently affecting some court services. Brazilian journalist Mateus Nunes has told BleepingComputer that several other Brazilian federal government agency websites went offline as well. It is not currently known if they are connected to the attack against the STJ. According to IT staff, systems were shut down to prevent further spread of the ransomware but case files and backups had already been encrypted. All court staff have been advised not to use any devices, work or personal, that were connected to the network. Official statements by STJ have not confirmed the attack as a ransomware incident, though ransom notes have revealed that the RansomExx group was behind the attack.

ANALYST NOTES

Binary Defense highly recommends all organizations provide regular security awareness training to help employees learn to spot phishing attacks. Unfortunately, in this case, it sounds like backups were encrypted during the attack. To ensure recovery in case of emergencies, organizations should follow the 3-2-1 rule as a backup guideline. The rule states that three copies of all critical data are retained on at least two different types of media and at least one of them is stored offline. This prevents all copies of backups from being lost or destroyed not just in ransomware attacks, but any other failure or emergency as well.

Source: https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/

http://www.stf.jus.br/portal/cms/verNoticiaDetalhe.asp?idConteudo=454634

The war in Ukraine and its impact on how China views Taiwan

Digging through Rust to find Gold: Extracting Secrets from Rust Malware

5 Critical Criteria for evaluating Managed Detection & Response (MDR)

How Ransomware Capabilities Are Evolving and What You Can Do to Keep Your Organization Secure

Threat Watch