Thanos Ransomware: Destructive Variant Targeting State-Run Organizations in the Middle East and North Africa
released on 2020-09-04 @ 04:02:10 PM
On July 6 and July 9, 2020, Unit42 observed files associated with an attack on two state-run organizations in the Middle East and North Africa that ultimately installed and ran a variant of the Thanos ransomware. The Thanos variant created a text file that displayed a ransom message requesting the victim transfer $20,000 into a specified Bitcoin wallet to restore the files on the system. We do not have visibility into the overall impacts of these attacks or whether or not the threat actors were successful in receiving a payment from the victims.