Alert: Mamba Ransomware Takes Full Hard Drives Captive

Jobs Plus grants
Image: Pixabay

The Mamba ransomware that encrypted the hard drives of the San Francisco Municipal Transportation Agency in 2016 is back.


By Danny Palmer

A powerful form of ransomware, which encrypts whole hard drives instead of just files, has suddenly returned — and there’s no way for victims to decrypt the data. Similar tactics have been used in other ransomware attacks, most notably Petya, which experts said was designed to outright destroy data rather than generate ransom money.

The return of Mamba ransomware has been flagged by Kaspersky Lab. Its return comes after researchers recently suggested that ransomware designed for destruction, rather than extorting a Bitcoin ransom for profit, is set to become the new normal.

While Mamba isn’t a particularly common form of ransomware, it claimed a high-profile victim in the form of the San Francisco Municipal Transportation Agency in November last year. The attack forced the operators to temporarily open the gates of ticket barriers and allow passengers to travel on the trains for free in order to minimise disruption.

The effectiveness of the ransomware stems partially from its use of a legitimate open source software tool, DiskCryptor, to fully lock down the hard drive of targeted organisations. Mamba first appeared in September 2016 and mainly targets corporates and other large organisations.

Continue reading the story on

Check the international cybersecurity project No More Ransom for possible decryption tools or to report your attack to Crypto Sheriff.

6 Immediate Actions Before Petya Ransomware Strikes

Why Ransomware is a Civic Threat & How to Protect Police Agencies


About the author

EfficientGov Staff

EfficientGov is an independent information service providing innovative solutions to fiscal and operational challenges facing cities and towns around the world.