New 0mega ransomware targets businesses in double-extortion attacks

A new ransomware operation named ‘0mega’ targets organizations worldwide in double-extortion attacks and demands millions of dollars in ransoms.

0mega (spelled with a zero) is a new ransomware operation launched in May 2022 and has attacked numerous victims since then.

A ransomware sample for the 0mega operation hasn’t yet been found, therefore there’s not much information on how files are encrypted.

However, we do know that the ransomware appends the .0mega extension to the encrypted file’s names and creates ransom notes named DECRYPT-FILES.txt.

These ransom notes include a link to a Tor payment negotiation site with a "support" chat that victims can use to contact the ransomware gang.

To log in to this site, victims must upload their ransom notes that include a unique Base64-encoded blob used by the site to identify the victim.

Like almost all enterprise-targeting ransomware operations, 0mega runs a dedicated data leak site that the threat actors use to publish stolen data if a ransom is not paid.

0mega’s leak site is currently hosting 152 GB of data stolen from an electronics repair company in a May attack.

Full article here https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/

#ransomware #omega #attack #extortion #yokdata #blog