Relatively new on the ransomware scene, Sodinokibi has already made impressive profits for its administrators and affiliates, some victims paying as much as $240,000, while a network infection netted $150,000 on average. These figures are not surprising when you look at the malware's recent activity. On August 16, Sodinokibi hit 22 local administrations in Texas and demanded a collective ransom of $2.5 million. It compromised multiple MSPs (managed service providers) spreading the malware to their customers. The latest victim is another MSP that offers data backup service to dental practices. The ransom, in this case, is allegedly $5,000 per client; hundreds were impacted. Since its discovery in April, Sodinokibi (a.k.a. REvil) has become prolific and quickly gained a reputation among cybercriminals in the ransomware business and security researchers. In mid-May, a Sodinokibi advertiser using the forum name UNKN deposited over $100,000 on underground forums to show that they meant serious business. Advertisements for the new file-encrypting malware started in early July on at least two forums. UNKN said that they were looking to expand their activity and that it was a private operation with "limited number of seats" available for experienced individuals. A screenshot of the announcement, provided to BleepingComputer by malware researcher Damian shows that UNKN describes the malware as being "private ransomware" flexible enough to adapt to the RaaS business model. The name of the ransomware is not disclosed in the forum posts but the researcher told us that he saw screenshots of the malware's administrative panel showing bot IDs that look the same as those for Sodinokibi. As seen in the screenshot below, one victim paid 27.7 bitcoins, which converted to more than $220,000 at the time of the transaction. Get deeper into this by visiting OUR FORUM.

A new Trojan dropper dubbed xHelper was observed while slowly but steadily spreading to more and more Android devices since May, with over 32,000 smartphones and tablets having been found infected in the last four months. Trojan droppers are tools used by threat actors to deliver other more dangerous malware strains to already compromised devices, including but not limited to clicker Trojans, banking Trojans, and ransomware. xHelper, dubbed Android/Trojan.Dropper.xHelper by Malwarebytes Labs' researchers who discovered it, was initially tagged as a generic Trojan dropper only to be upgraded to the rank of a fully-fledged menace after climbing into the security vendor's top 10 most detected mobile malware in just a few months. Besides a large number of devices, it was found on, xHelper also comes with a number of other peculiarities including the fact that it spreads using DEX (Dalvik Executable) files camouflaged as JAR archives, containing compiled Android application code. This method of infecting new Android devices is quite unique given that most mobile Trojan droppers would use an APK (Android Package) bundled with an infected app, APKs which get subsequently dropped within the Assets folder and then installed and executed on the compromised smartphone or tablet. The encrypted DEX files used by xHelper as part of its infection process are first decrypted and then compiled using the dex2oat compiler tool into an ELF (Executable and Linkable Format) binary which gets executed natively by the device's processor. There's lots more posted on OUR FORUM.