In this video, we show SentinelOne’s ability to detect and mitigate Rancoz ransomware. Rancoz was first observed in the wild in May 2023 and operates as a multi-extortion group, hosting a TOR-based website with non-compliant victim names and associated data. Associated attack campaigns have been tracked across multiple industries and geographies.

Rancoz attackers do not discriminate when it comes to victimology outside of targeting large enterprises. There does not appear to be any clear exclusion zones or industries (e.g., medical or educational institutions) for threat actors deploying Rancoz.

Upon execution, the ransomware will enumerate all local drives and attempt to encrypt all available and applicable file types. Command-line parameters can be used to target the encryption to specific files or folders. Otherwise, the ransomware will attempt to encrypt all local and accessible volumes. Rancoz will also delete VSS (Volume Shadow Copies) via VSSADMIN.EXE and then reconfigure RDP/Terminal Server settings for affected hosts. Encrypted files are noted with the “.rec_rans” file extension.

The SentinelOne Singularity XDR Platform can identify and stop any malicious activities and items related to Rancoz ransomware and return systems to their original state using either the Repair or Rollback feature.

Watch the demo to understand how SentinelOne's advanced threat detection and prevention capabilities can protect your systems against threats like Rancoz. For more technical insights and cybersecurity updates, subscribe to our channel.

~~~Subscribe to our channels:~~~
Website: [ Ссылка ]
LinkedIn: [ Ссылка ]
Twitter: [ Ссылка ]
Facebook: [ Ссылка ]
Instagram: [ Ссылка ]
~~~~~~~~~~~~
SentinelOne is the only cybersecurity solution encompassing AI-powered prevention, detection, response, and hunting across endpoints, containers, cloud workloads, and IoT devices in a single autonomous platform. With SentinelOne, organizations gain full transparency into everything happening across the network at machine speed – to defeat every attack, at every stage of the threat lifecycle. To learn more visit www.sentinelone.com.

#ransomwareprotection #endpoint #malware
#Rancoz #sentinelone #malware #security #cybersecurity #ransomware

свернуть