Top Tweets for #ByteToBreach

Our latest blog post "A Deep Dive into ByteToBreach's ByteToCrypt ransomware" is here! There are multiple quirky aspects of this bytetocrypt and the known actor's TTPs, suggesting that this ransomware was developed by a capable software developer, but less experienced at ransomware. - the encryption implementation is fragile and error-prone but not cryptographically breakable - this code is not an ESXi-aware platform but has been deployed to ESXi environments - the ransomware is not runtime interactive for its operator - following encryption and ransom tasks, it autoexecutes a set of anti-forensics capabilities This immaturity invites extra attention to bytetocrypt's encryption capabilities. But when it comes to its implementation, all-in-all the technology presented is brittle but effective. Our assessment of the ransomware is based on several factors: - it ignores randomness, cryptographic, I/O (deletion and rename), and anti-forensics failures - mistakes read errors for end-of-file - truncates paths to fixed buffers - loses metadata - can announce success after partial or failed work Continue reading our analysis: https://t.co/d0blUQLCuQ