Python-Based Malware Powers RansomHub Ransomware to Exploit Network Flaws
Researchers studying cybersecurity have described an assault in which a threat actor used a Python-based backdoor to keep ongoing access to compromised endpoints. The threat actor then used this access to spread the RansomHub ransomware across the target network.
GuidePoint Security claims that the JavaScript virus SocGholish (also known as FakeUpdates), which is known to be disseminated through drive-by campaigns that deceive unwary users into downloading fake web browser updates, was responsible for the first access.
These attacks typically use black hat Search Engine Optimization (SEO) techniques to lead users from search engine results to legitimate-but-infected websites. When SocGholish is executed, it connects to a server under the control of the attacker in order to obtain se...