Security News > 2023 > February > New EX-22 Tool Empowers Hackers with Stealthy Ransomware Attacks on Enterprises

Some of the notable features include establishing a reverse shell with elevated privileges, uploading and downloading files, logging keystrokes, launching ransomware to encrypt files, and starting a live VNC session for real-time access.
The cybersecurity firm assessed with moderate confidence that threat actors responsible for creating the malware are operating from North, East, or Southeast Asia and are likely former affiliates of the LockBit ransomware.
Advertised as a fully undetectable malware on Telegram and YouTube, EX-22 is offered for $1,000 a month or $5,000 for lifetime access.
Criminal actors purchasing the toolkit are provided a login panel to access the EX-22 server and remotely control the malware.
Since its first appearance on November 27, 2022, the malware authors have continuously iterated the toolkit with new features, indicating active development work.
The connections to LockBit 3.0 arise from technical and infrastructure overlaps, with both malware families utilizing the same domain fronting mechanism for hiding command-and-control traffic.
News URL
https://thehackernews.com/2023/02/new-ex-22-tool-empowers-hackers-with.html
Related news
- Texas State Bar warns of data breach after INC ransomware claims attack (source)
- Sensata Technologies hit by ransomware attack impacting operations (source)
- Russian hackers attack Western military mission using malicious drive (source)
- Ransomware attack cost IKEA operator in Eastern Europe $23 million (source)
- Kidney dialysis firm DaVita hit by weekend ransomware attack (source)
- Ahold Delhaize confirms data theft after INC ransomware claims attack (source)
- Interlock ransomware gang pushes fake IT tools in ClickFix attacks (source)
- Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery (source)
- Hackers abuse Zoom remote control feature for crypto-theft attacks (source)
- DPRK Hackers Steal $137M from TRON Users in Single-Day Phishing Attack (source)