Atom Silo Ransomware Gang Exploits Confluence Servers
Cybersecurity experts are reporting a new file-locker family, which appears to be referred to as the Atom Silo Ransomware. It shares similarities with two file-encryption Trojans from the past few months – LockBit Ransomware and the LockFile Ransomware. However, the Atom Silo Ransomware gang appears to use novel tactics and exploits to spread their malicious software.
For starters, they are abusing a recent vulnerability in the Confluence Server and Data Center, also referred to as CVE-2021-26084. Although this software vulnerability is already patched, there are tens of thousands of servers that are missing the critical security update. Recently, these servers were targeted by multiple cybercrime groups specializing in illegal cryptocurrency mining operations. However, the Atom Silo Ransomware takes these attacks to another level by stealing and encrypting the data of victims.
Atom Silo Ransomware Gang Aids Attack with an Unnamed Backdoor Trojan
It is important to add that the Atom Silo Ransomware is the final payload that his group uses to infect vulnerable servers. Prior to this, they plant a backdoor Trojan, which enables them to collect more data about the infected victim, and try to spread laterally across a network. Unfortunately, there is no way to undo Atom Silo Ransomware's encryption at the moment.
The criminals behind this ransomware operation are not only encrypting files – they also transfer them to their server prior to encryption. This means that victims risk not only losing their files, but having them leaked to the public as well. This extortion method is rapidly gaining popularity among cybercriminals, and the Atom Silo Ransomware gang is just one of the latest groups to take advantage of it.
Needless to say, a high-profile threat actor like the one in question demands a significant ransom fee. One of Atom Silo Ransomware's victims was told to pay $200,000 via Bitcoin to prevent their data from being leaked, and to receive a decryption tool. The crooks also offer a '50% off' promotion for victims who pay within 48 hours of the attack. Last but not least, the ransomware operators give victims limited time to comply with their request.
Recovering from attacks like this one is never easy, so preventing them is in your best interest. In this case, applying the latest updates and security patches, as well as using antivirus software is more than enough to mitigate the Atom Silo Ransomware attack.
