MalasLocker Ransomware Targets Zimbra Servers, Demands Charity Donations Instead of Ransom

In the ever-evolving landscape of cyber threats, a new player has emerged in the form of MalasLocker ransomware. This notorious ransomware variant has been active since March 2023 and has a distinct modus operandi: instead of demanding traditional ransom payments, it seeks charity donations. This unique twist sets it apart from other ransomware strains and poses a significant challenge for organizations targeted by this malicious group.

Targeted industries and regions

The MalasLocker group primarily focuses on corporate companies that offer various business services, software solutions, and manufacturing services. While their attacks have been observed in multiple regions, they appear to have a particular interest in targeting organizations in Italy, Russia, and the United States. This geographical spread highlights their international reach and emphasizes the need for heightened vigilance in these areas.

Method of attack

The threat actors behind MalasLocker employ sophisticated phishing techniques to target their victims. They distribute malicious JSP documents via phishing emails, specifically targeting users of Zimbra, a popular collaboration software suite. By enticing unsuspecting recipients to open these infected documents, the attackers gain unauthorized access to the victims’ systems.

Specific file upload locations

To further their nefarious objectives, the MalasLocker group uploads suspicious JSP files to specific directories within Zimbra servers. These files, such as heartbeat.jsp, info.jsp, and Startup1_3.jsp, are typically found in directories like /opt/zimbra/jetty_base/webapps/zimbra/ or /opt/zimbra/jetty/webapps/zimbra/public. This strategic placement allows the ransomware to propagate throughout the system, encrypting critical files and wreaking havoc on the victims’ infrastructure.

Exploiting Zimbra vulnerabilities

In addition to leveraging phishing techniques, the MalasLocker group takes advantage of vulnerabilities associated with Zimbra servers. These vulnerabilities include CVE-2022-27924 (Zimbra memcache command injection), CVE-2022-27925 (Zimbra admin directory traversal), CVE-2022-30333 (UnRAR Linux/UNIX directory traversal), and CVE-2022-37042 (Zimbra auth bypass, remote code execution). These vulnerabilities allow the threat actors to gain unauthorized access to the targeted systems. Exploiting these weaknesses gives the ransomware a foothold to carry out its encryption operations.

Encryption Software and File Extensions

To encrypt the victim’s files, the MalasLocker group utilizes the “AGE” encryption tool. Interestingly, they do not append any file extensions to the encrypted files, making it even more challenging for victims to identify the affected files and recover them. This deliberate choice by the attackers adds an extra layer of complexity to the decryption process.

Hosting a Tor website

To communicate with their victims, the MalasLocker group maintains a TOR website. On this site, they have published a list of 160 victims who have fallen prey to the ransomware. To protect the confidentiality of the affected companies, the group has censored the images representing their names. Interestingly, the welcome greeting on the TOR website indicates that the threat group is based in Spain, with a motto written in Spanish that roughly translates to “we are bad… we can be even worse.”

Ransom Note and Contact Details

The ransom note, provided in a file named Readme.txt, takes a unique approach compared to traditional ransom demands. Instead of asking for a specific ransom amount, the MalasLocker group requests charity donations to be made in exchange for the decryptor tools. The note includes instructions on how to make these donations and how to reach the threat group for further communication.

Prevention and best practices

As with any cybersecurity threat, prevention is key when dealing with MalasLocker ransomware. One of the primary measures organizations can take is to regularly patch and update their Zimbra applications to the latest version. Keeping software updated ensures that known vulnerabilities are addressed before threat actors can exploit them. Additionally, implementing robust phishing awareness training programs and maintaining strong email security measures can help mitigate the risk of falling victim to phishing emails.

MalasLocker ransomware represents a new breed of cyber threat that adopts novel tactics to achieve its objectives. By targeting Zimbra servers and demanding charity donations instead of traditional ransom payments, this group poses a significant challenge for organizations worldwide. It is crucial for businesses to stay vigilant, update their software regularly, and implement proactive cybersecurity measures to fend off such attacks. As the threat landscape continues to evolve, organizations must adapt their defenses accordingly to protect their valuable data and infrastructure from these malicious actors.

Explore more

AI Revolutionizes Corporate Finance: Enhancing CFO Strategies

Imagine a finance department where decisions are made with unprecedented speed and accuracy, and predictions of market trends are made almost effortlessly. In today’s rapidly changing business landscape, CFOs are facing immense pressure to keep up. These leaders wonder: Can Artificial Intelligence be the game-changer they’ve been waiting for in corporate finance? The unexpected truth is that AI integration is

AI Revolutionizes Risk Management in Financial Trading

In an era characterized by rapid change and volatility, artificial intelligence (AI) emerges as a pivotal tool for redefining risk management practices in financial markets. Financial institutions increasingly turn to AI for its advanced analytical capabilities, offering more precise and effective risk mitigation. This analysis delves into key trends, evaluates current market patterns, and projects the transformative journey AI is

Is AI Transforming or Enhancing Financial Sector Jobs?

Artificial intelligence stands at the forefront of technological innovation, shaping industries far and wide, and the financial sector is no exception to this transformative wave. As AI integrates into finance, it isn’t merely automating tasks or replacing jobs but is reshaping the very structure and nature of work. From asset allocation to compliance, AI’s influence stretches across the industry’s diverse

RPA’s Resilience: Evolving in Automation’s Complex Ecosystem

Ever heard the assertion that certain technologies are on the brink of extinction, only for them to persist against all odds? In the rapidly shifting tech landscape, Robotic Process Automation (RPA) has continually faced similar scrutiny, predicted to be overtaken by shinier, more advanced systems. Yet, here we are, with RPA not just surviving but thriving, cementing its role within

How Is RPA Transforming Business Automation?

In today’s fast-paced business environment, automation has become a pivotal strategy for companies striving for efficiency and innovation. Robotic Process Automation (RPA) has emerged as a key player in this automation revolution, transforming the way businesses operate. RPA’s capability to mimic human actions while interacting with digital systems has positioned it at the forefront of technological advancement. By enabling companies