{"id":2514,"date":"2018-06-04T05:24:12","date_gmt":"2018-06-03T22:24:12","guid":{"rendered":"https:\/\/humanit.asia\/?p=2514"},"modified":"2019-07-22T14:26:26","modified_gmt":"2019-07-22T07:26:26","slug":"bip-dharma-ransomware","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/bip-dharma-ransomware\/","title":{"rendered":"Bip Dharma Ransomware Variant Released into the Wild"},"content":{"rendered":"<p>Today,\u00a0<a href=\"https:\/\/twitter.com\/demonslay335\/status\/996371482795274240\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Michael Gillespie<\/a>\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.\u00a0<a href=\"https:\/\/twitter.com\/JakubKroustek\/status\/996373009647702016\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Jakub Kroustek<\/a>\u00a0then discovered some samples to confirm that it was indeed a new Dharma variant. This new version will append the .Bip extension to encrypted files. It is not known exactly how this variant is being distributed, but in the past Dharma is typically spread by hacking into Remote Desktop Services and manually installing the ransomware.<\/p>\n<p>When the Bip ransomware\u00a0variant is installed, it will scan a computer for data files and encrypt them. When encrypting a file it will append an extension in the format of .id-[id].[email].bip. For example, a file called\u00a0<strong>test.jpg<\/strong>\u00a0would be encrypted and renamed to\u00a0<strong>test.jpg.id-BCBEF350.[Beamsell@qq.com].bip<\/strong>.<\/p>\n<p>It should be noted that this ransomware will encrypt mapped network drives, shared virtual machine host drives,\u00a0\u00a0and unmapped network shares. So it is important to make sure your network&#8217;s shares are locked down so that only those who actually need access have permission.<\/p>\n<p>The other note is called\u00a0<strong>FILES ENCRYPTED.txt<\/strong>\u00a0and can be found on the desktop.<\/p>\n<h2>It is not possible to decrypt the Dharma Bip Ransomware\u00a0Variant<\/h2>\n<p>Unfortunately, at this time there is no way to decrypt files encrypted by the Bip Ransomware variant for free.<\/p>\n<p>The only way to recover encrypted files is via a backup, or if you are incredibly lucky, through Shadow Volume Copies. Though\u00a0Dharma does attempt to remove Shadow Volume Copies, in rare cases ransomware infections fail to do so for whatever reason. Due to this, if you do not have a viable backup, I always suggest people try as a last resort to\u00a0<a href=\"https:\/\/www.bleepingcomputer.com\/tutorials\/how-to-recover-files-and-folders-using-shadow-volume-copies\/\" target=\"_blank\" rel=\"noopener noreferrer\">restore encrypted files from Shadow Volume Copies<\/a>\u00a0as well.<\/p>\n<p>Why is this important? Well as we know Thailand is slower than most in patching and also rather sloppy at policies and security in the infrastructure.<\/p>\n<p>This is spreading around business via email and to be honest going through some antispam solutions like a knife through warm butter.<\/p>\n<p>Thanks to bleeping computer for the main history.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a  [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[110],"tags":[],"class_list":["post-2514","post","type-post","status-publish","format-standard","hentry","category-security-th"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Bip Dharma Ransomware Variant Released into the Wild - humanit managed services<\/title>\n<meta name=\"description\" content=\"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"th_TH\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bip Dharma Ransomware Variant Released into the Wild - humanit managed services\" \/>\n<meta property=\"og:description\" content=\"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"humanit managed services\" \/>\n<meta property=\"article:published_time\" content=\"2018-06-03T22:24:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-07-22T07:26:26+00:00\" \/>\n<meta name=\"author\" content=\"Admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 \u0e19\u0e32\u0e17\u0e35\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/\"},\"author\":{\"name\":\"Admin\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"headline\":\"Bip Dharma Ransomware Variant Released into the Wild\",\"datePublished\":\"2018-06-03T22:24:12+00:00\",\"dateModified\":\"2019-07-22T07:26:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/\"},\"wordCount\":359,\"articleSection\":[\"Security\"],\"inLanguage\":\"th\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/\",\"url\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/\",\"name\":\"Bip Dharma Ransomware Variant Released into the Wild - humanit managed services\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\"},\"datePublished\":\"2018-06-03T22:24:12+00:00\",\"dateModified\":\"2019-07-22T07:26:26+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\"},\"description\":\"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\\\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/#breadcrumb\"},\"inLanguage\":\"th\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/old.humanit.asia\\\/bip-dharma-ransomware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/old.humanit.asia\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bip Dharma Ransomware Variant Released into the Wild\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#website\",\"url\":\"https:\\\/\\\/old.old.humanit.asia\\\/\",\"name\":\"humanit managed services\",\"description\":\"making technology easy\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/old.old.humanit.asia\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"th\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/old.old.humanit.asia\\\/#\\\/schema\\\/person\\\/e7a3d665ee9cc6526fb6fdc92f4eb09c\",\"name\":\"Admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"th\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g\",\"caption\":\"Admin\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Bip Dharma Ransomware Variant Released into the Wild - humanit managed services","description":"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/","og_locale":"th_TH","og_type":"article","og_title":"Bip Dharma Ransomware Variant Released into the Wild - humanit managed services","og_description":"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.","og_url":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/","og_site_name":"humanit managed services","article_published_time":"2018-06-03T22:24:12+00:00","article_modified_time":"2019-07-22T07:26:26+00:00","author":"Admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Admin","Est. reading time":"2 \u0e19\u0e32\u0e17\u0e35"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/#article","isPartOf":{"@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/"},"author":{"name":"Admin","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"headline":"Bip Dharma Ransomware Variant Released into the Wild","datePublished":"2018-06-03T22:24:12+00:00","dateModified":"2019-07-22T07:26:26+00:00","mainEntityOfPage":{"@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/"},"wordCount":359,"articleSection":["Security"],"inLanguage":"th"},{"@type":"WebPage","@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/","url":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/","name":"Bip Dharma Ransomware Variant Released into the Wild - humanit managed services","isPartOf":{"@id":"https:\/\/old.old.humanit.asia\/#website"},"datePublished":"2018-06-03T22:24:12+00:00","dateModified":"2019-07-22T07:26:26+00:00","author":{"@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c"},"description":"Today,\u00a0Michael Gillespie\u00a0noticed what appeared to be a new variant of the Crysis\/Dharma Ransomware uploaded to his ID-Ransomware\u00a0site.","breadcrumb":{"@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/#breadcrumb"},"inLanguage":"th","potentialAction":[{"@type":"ReadAction","target":["https:\/\/old.humanit.asia\/bip-dharma-ransomware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/old.humanit.asia\/bip-dharma-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/old.humanit.asia\/"},{"@type":"ListItem","position":2,"name":"Bip Dharma Ransomware Variant Released into the Wild"}]},{"@type":"WebSite","@id":"https:\/\/old.old.humanit.asia\/#website","url":"https:\/\/old.old.humanit.asia\/","name":"humanit managed services","description":"making technology easy","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/old.old.humanit.asia\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"th"},{"@type":"Person","@id":"https:\/\/old.old.humanit.asia\/#\/schema\/person\/e7a3d665ee9cc6526fb6fdc92f4eb09c","name":"Admin","image":{"@type":"ImageObject","inLanguage":"th","@id":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d8f90c345033af4c0eb51ef25202eced8799a4331f9c232149e984d2570105b?s=96&d=mm&r=g","caption":"Admin"}}]}},"_links":{"self":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/comments?post=2514"}],"version-history":[{"count":2,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2514\/revisions"}],"predecessor-version":[{"id":2855,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/posts\/2514\/revisions\/2855"}],"wp:attachment":[{"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/media?parent=2514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/categories?post=2514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/old.humanit.asia\/th\/wp-json\/wp\/v2\/tags?post=2514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}