Previous reports indicate that IceFire targeted technology companies SentinelLabs observed these recent attacks against organizations in the media and entertainment sector. The attackers tactics are consistent with those of the ‘big-game hunting’ (BGH) ransomware families, which involve double extortion, targeting large enterprises, using numerous persistence mechanisms, and evading analysis by deleting log files.

Prior to this report, IceFire had only shown a Windows-centric focus.

The iFire file extension is associated with known reports of IceFire, a ransomware family noted by MalwareHunterTeam in March 2022.Īnother new ransomware just appeared: IceFire.Īlready seen victim companies from multiple countries, including multiple victims from 1-1 countries in the past < 40 hours, so they started “hard” it seems… /QfguAicNYO SentinelLabs recently observed a novel Linux version of the IceFire ransomware being deployed in mid February against enterprise networks. This strategic shift is a significant move that aligns them with other ransomware groups who also target Linux systems.

The operators of the IceFire malware, who previously focused only on targeting Windows, have now expanded their focus to include Linux.

Currently observations indicate the attackers deployed the ransomware by exploiting CVE-2022-47986, a deserialization vulnerability in IBM Aspera Faspex file sharing software.

In recent weeks SentinelLabs observed novel Linux versions of IceFire ransomware being deployed within the enterprise network intrusions of several media and entertainment sector organizations worldwide.

Kdbx 4