Original XPan Ransomware Returns, Targets Brazilian SMBs

BY Tom Spring April 25, 2017
                                               

 Brazilian cybercriminals are using the original version of the XPan ransomware, targeting small to medium-sized business based in Brazil with the malware.
 
XPan works by penetrating poorly protected remote desktop protocol (RDP) connections. Hackers use those connections to manually install the ransomware and encrypt files, according to a report by Kaspersky Lab’s Global Research and Analysis Team.
 
“XPan is a very targeted attack against servers with RDP connections exposed to the internet. The bad guys do a brute force attack, enter, and run the ransomware manually in most cases,” said Fabio Assolini, a Kaspersky Lab researcher.
 
Full Article