The Health Care Sector Cybersecurity Coordination Center (IC3) recently released an Analyst’s Note to health care organizations providing information on a new variant of ransomware called Venus (also known as GOODGAME).
According to IC3, the threat actors “are known to target publicly exposed Remote Desktop Services to encrypt Windows devices.” The ransomware then “will attempt to terminate 39 processes associated with database servers and Microsoft Office applications” and will “delete event logs, Shadow Copy Volumes, and disable Data Execution Prevention using” AES and RSA algorithms and append the ‘.venus’ extension and a ‘goodgamer’ filemarker.