Have you ever heard of the STOP Ransomware? Probably not, as few write about it, most researchers don't cover it, and for the most part, it targets consumers through cracked software, adware bundles, and shady sites. Ryuk, GandCrab, and Sodinkibi get huge and deserved media attention because they generate giant ransom payments, can halt business and local governments, and affect enterprise customers, which are the bread and butter for AV companies. Yet, based on Michael Gillespie's ID Ransomware submissions and support requests at BleepingComputer, for the past year, it has been the most actively distributed ransomware in the wild. To give you some perspective, the ransomware identification service ID Ransomware gets approximately 2,500 ransomware submissions a day. Of those, between 60-70 % are STOP ransomware submissions. This amount of submissions beats out any other ransomware that users are submitting to the service when trying to get help. STOP is getting so big that the image above looks like Pacman eating all of the other ransomware! In order to distribute STOP, the ransomware developers have teamed up with shady sites and adware bundles. These sites promote fake software cracks or free programs, which are really adware bundles that install a variety of unwanted software and malware onto a user's computer. One of the programs installed via these bundles is the STOP Ransomware. Some of the reported cracks that are have been seen installing STOP include KMSPico, Cubase, Photoshop, and antivirus software. It is not only cracked, though, as many of these shady sites offer downloads of free software, but are simply just adware bundles that install the ransomware. Even worse, some of these variants also bundle the Azorult password-stealing Trojan with the ransomware for a double-attack on the victim. Otherwise, there is nothing particularly special about the STOP Ransomware.  It encrypts just like any other ransomware, appends an extension, and drops a ransom note. What makes it so much of a pain is the sheer amount of variants that keep being released. In fact, right now, there are more than 159 variants that we know about. Visit OUR FORUM to learn more most active and destructive ransomware.

Password manager LastPass has released an update last week to fix a security bug that exposes credentials entered on a previously visited site. The bug was discovered last month by Tavis Ormandy, a security researcher with Project Zero, Google's elite security and bug-hunting team. LastPass believed to be the most popular password manager app today, fixed the reported issue in version 4.33.0, released last week, on September 12. In a blog post, the company said the bug only impacts its Chrome and Opera browser extensions. If users have not enabled an auto-update mechanism for their LastPass browser extensions, they're advised to perform a manual update as soon as possible. This is because yesterday, Ormandy published details about the security flaw he found. The security researcher's bug report walks an attacker through the steps necessary to reproduce the bug. Since the bug relies on executing malicious JavaScript code alone, with no other user interaction, the bug is considered dangerous and potentially exploitable. Attackers could lure users on malicious pages and exploit the vulnerability to extract the credentials users had entered on previously-visited sites. According to Ormandy, this isn't as hard as it sounds, as an attacker could easily disguise a malicious link behind a Google Translate URL, trick users into visiting the link, and then extract credentials from a previously visited site. Like any other applications, password managers are sometimes vulnerable to bugs, which are in all cases eventually fixed. Despite this vulnerability, users are still advised to rely on a password manager whenever they can. Using a password manager is many times better than leaving passwords stored inside a browser, from where they can be easily extracted by forensic tools and malware. For more visit OUR FORUM.