{"id":48590,"date":"2022-09-25T08:50:14","date_gmt":"2022-09-25T08:50:14","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/noberus-ransomware-gets-info-stealing-upgrades-targets-veeam-backup-software\/"},"modified":"2022-09-25T08:50:14","modified_gmt":"2022-09-25T08:50:14","slug":"noberus-ransomware-gets-info-stealing-upgrades-targets-veeam-backup-software","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/noberus-ransomware-gets-info-stealing-upgrades-targets-veeam-backup-software\/","title":{"rendered":"Noberus ransomware gets info-stealing upgrades, targets Veeam backup software"},"content":{"rendered":"

Crooks spreading the Noberus ransomware are adding weapons to their malware to steal data and credentials from compromised networks.<\/p>\n

An extensively updated version of the Exmatter<\/a> data exfiltration tool was seen last month being used with Noberus in ransomware infections, and at least one affiliate using Noberus was detected using Eamfo, the info-stealing malware that connects to the SQL database where a victim’s Veeam backup software installation stores credentials, according to researchers in Symantec’s Threat Hunting Team.<\/p>\n

The adoption of the tactics, tools, and procedures (TTPs) by Coreid \u2013 the ransomware-as-a-service (RaaS) group thought to be behind Noberus \u2013 and its affiliates makes “the threat more dangerous than ever” and the gang’s “continuous development of its ransomware and its affiliate programs indicates that this sophisticated and well-resourced attacker has little intention of going anywhere anytime soon,” the researchers wrote in a report<\/a> on Thursday.<\/p>\n