Hive ransomware on Exchange servers

Hive ransomware has been targeting Microsoft exchange servers lately vulnerable to ProxyShell security issues in order to deploy various backdoors. Once the backdoor has been placed various attacks can be performed including but not limited to network reconnaissance, stealing admin accounts, taking valuable data, and even installing and deploying file-encrypting algorithms.

hive ransomware

ProxyShell wide abuse

ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allows remote code execution without authentication on vulnerable deployments. The flaw has been used in past by various ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile.

Security vulnerabilities have been reported to be fully patched on May 2021 but how Hive was able to still be successful in exploiting PowerShell and infiltrating into the system there seems to be still some unpatched and open issues.

Hive

Hive has gone a long way since it was first observed in the wild back in June 2021, having a successful start that prompted the FBI to release a dedicated report on its tactics and indicators of compromise.

In October 2021, the Hive gang added Linux and FreeBSD variants, and in December it became one of the most active ransomware operations in attack frequency.

Last month, researchers at Sentinel Labs reported on a new payload-hiding obfuscation method employed by Hive, which indicates active development.

Do You Need Help with Your Device?

Our Team of Experts May Help
Troubleshoot.Tech Experts are There for You!
Replace damaged files
Restore performance
Free disk space
Remove Malware
Protects WEB browser
Remove Viruses
Stop PC freezing
GET HELP
Troubleshoot.Tech experts work with all versions of Microsoft Windows including Windows 11, with Android, Mac, and more.

Share this article:

You might also like

Taskbar has disappeared from the Desktop
As you know, the Taskbar is one of the integral parts of the Windows desktop and it has been there since the release of Windows 1.0 and up until now with Windows 10. Since then, Microsoft has been modifying the Taskbar with a new design which makes it a home for new features such as Windows Search, Task View, and many more. However, there are times when you may that the Taskbar has disappeared or has stopped responding. If you experience either one of these scenarios, read on as this post will walk you through what you can do to resolve the problem. Here are some suggestions you can check out to resolve the issue with the Taskbar in Windows 10 but before you proceed, make sure that you create a System Restore point first. To do that, follow these steps:
  • In the Start search, type in “create a restore point” and click the entry “System Properties”.
  • Next, select the main system drive under Protection Settings and click on the Configure button.
  • After that, select the “Turn on system protection” option and then click on the Apply and OK buttons to save the changes made.
Once you’ve created a System Restore point, refer to the troubleshooting steps below to fix the Taskbar in Windows 10.

Option 1 – Try to restart the Explorer process

This may sound really basic but it actually is a proven method to fix the Taskbar issue. So if anything gets stuck on the system tray or the Taskbar, you can always fix it by restarting the explorer.exe. How? Refer to these steps:
  • First, right-click on the Taskbar and select the Task Manager.
  • After opening the Task Manager, go to the Processes tab and look for the process named “Windows Explorer”.
  • Then right-click on that process and select the option to Restart. Afterward, you should now be seeing the Taskbar as this will reload the whole Windows Shell.

Option 2 – Unhide the Taskbar using the Settings app

It is possible that the Taskbar could be hidden so you can try to unhide it using the Settings app.
  • Tap the Win + I keys to open Settings.
  • After that, go to Personalization > Taskbar.
  • From the main section, make sure that the “Automatically hide the task in desktop mode” is toggled to the off position. However, if it’s already off then proceed to the next options below.

Option 3 – Make sure that you are not in Tablet Mode

Since Windows 10 is designed to work on both desktop and mobile devices, it could be that your computer has slipped into Tablet Mode which explains why you’re not seeing the Taskbar. To check if your computer is really in Tablet Mode, follow these steps:
  • Go to the Start menu and select Settings.
  • Next, select the System setting and from the left pane select the Tablet Mode.
  • From there, make sure that the buttons next to the options given below are set to the off position:
    • Hide app icons on the taskbar in tablet mode
    • Automatically hide the taskbar in tablet mode

Option 4 – Try to check the Projection Settings

You might also want to check the Projection settings as it could be the reason why Taskbar has disappeared.
  • Tap the Win + P keys to open the Windows Projection settings.
  • Next, make sure that you select the “PC screen only” option and then check if your Taskbar has now appeared or not.
Read More
Fix 0x00000016 Blue Screen Error
If you are a gamer, you might have encountered either the CID HANDLE CREATION or VIDEO TDR ERROR errors with an error code of 0x00000016 as you play a game. These kinds of Stop errors have something to do with the Graphics card driver. It could be that your Graphics card driver needs to be updated or it may be corrupted. Whichever the case is, you can try fixing this error using the given solutions below but before you proceed, make sure to create a System Restore Point first so that you can easily roll back to the previous state of your computer in case something does not go as expected.

Option 1 – Try checking if your graphics card is enabled and update it as well

Although the problem is quite massive, the fix could be as simple as enabling the graphics card if it turns out to be disabled. There might be some strange reason why your graphics card disables itself. Thus, the best and first option you can try is to check if the graphics card is enabled or not. To do so, follow these steps:
  • Tap the Win + R keys to open the Run dialog box.
  • Then type “devmgmt.msc” in the field and hit Enter to open the Device Manager.
  • After opening the Device Manager, look for your graphics card option among the list of device drivers. Once you found it, check if it is enabled or not. If it’s not enabled, you should see a gray arrow pointing downwards. Right-click on the card and select Enabled.
  • Next, right-click on the graphics card once more and click on the Update Driver Software option and then click on the “Search automatically for updated driver software” option.

Option 2 – Reinstall the Graphics card drivers

  • Tap Win + R to open Run then type “devmgmt.msc” in the field and hit Enter to open the Device Manager.
  • From there, look for the Display adapters and uninstall each one of the graphics card drivers by right-clicking on them and selecting the Uninstall device option.
  • After uninstalling the graphics card drivers, close the Device Manager and tap Win + R to open Run once again.
  • After that, type “appwiz.cpl” in the field and hit Enter to open Programs & Features in the Control Panel.
  • Next, look for any program that’s related to your GPU manufacturers like Nvidia, AMD, or Intel. Right-click on any GPU-related entry and click on Uninstall to uninstall them and then follow the next on-screen instructions that appear afterward.
  • Now restart your computer.
  • Once your computer has restarted, go to the GPU manufacturer’s website and download the latest driver version for your graphics card model and then install it.
  • Restart your computer once again. That should fix the problem.

Option 3 – Try reinstalling the game

If updating and reinstalling your Graphics card driver didn’t help, then you can try to reinstall the game where you’re getting the CID HANDLE CREATION or VIDEO TDR ERRORS.

Option 4 – Uninstall the programs you installed recently

Chances are, some programs that you just installed might be the one that’s causing the BSOD error. Thus, you need to uninstall the program to resolve the problem.
  • In the search box, type in “control” and then click on Control Panel (desktop app) among the search results.
  • After that, select Programs and Features from the list which will give you a list of all the programs installed on your computer.
  • From there, look for the concerned program and select it and then uninstall it.
Note: If you have downloaded the app from the Windows Store, you can simply right-click on it from the application list and then uninstall it. In addition, you might also want to check the hardware components of your computer that might not support the operating system itself. You can disconnect all the external devices like USB drives, scanners, printers, etc., and then reboot your PC. After that, add the devices again one after the other and check if the BSOD error is now fixed or not.

Option 5 – Try disabling your monitor’s Sleep functionality

There are times when the Sleep functionality of your monitor can also cause BSOD errors like CID HANDLE CREATION or VIDEO TDR errors. There are also times when the graphics card is running in the background and the display goes to sleep and then it’s turned back on but you encounter this kind of Blue Screen error. This is why you can try to disable your computer monitor’s Sleep mode.

Option 6 – Run the Blue Screen Troubleshooter

The Blue Screen troubleshooter is a built-in tool in Windows 10 that helps users in fixing BSOD errors like CID HANDLE CREATION or VIDEO TDR errors. It can be found on the Settings Troubleshooters page. To use it, refer to these steps:
  • Tap the Win + I keys to open the Settings panel.
  • Then go to Update & Security > Troubleshoot.
  • From there, look for the option called “Blue Screen” on your right-hand side and then click the “Run the troubleshooter” button to run the Blue Screen Troubleshooter and then follow the next on-screen options. Note that you might have to boot your PC into Safe Mode.

Option 7 – Try to run the Chkdsk utility

Running the CHKDSK utility might also help you resolve the CID HANDLE CREATION or VIDEO TDR errors. If your hard drive has issues with integrity, the update will really fail as the system will think that it’s not healthy and that’s where the CHKDSK utility comes in. The CHKDSK utility repairs hard drive errors that might be causing the problem.
  • Open Command Prompt with admin privileges.
  • After opening Command Prompt, execute the following command and hit Enter:
chkdsk /f /r
  • Wait for the process to be completed and then restart your computer.
Read More
Fix Failed to transfer logged messages ...
One of the most common hardware issues with any PC usually has something to do with the hard drive so if your hard drive experiences some errors, you could end up losing a lot of important information that’s stored in your computer. This is why Windows provided users with the CHKDSK utility which helps in looking for bad sectors on the drive. However, there are times when the CHKDSK utility could also face issues like the following error:
“Failed to transfer logged messages to the log event with status 50.”
According to security experts, this error is most likely due to the hard drive or RAM being in a “Read-only” state. It could also be due to some physical issues with the hard drive. On the other hand, it could be that the system is prevented from creating logs by some drive, service, or malware. To fix this error, you have to check if the hard disk is writable. You could also try to run the CHKDSK utility in Safe Mode or you could also check the physical status of your hard disk or external drive.

Option 1 – Check if the hard disk is writable

Although the CHKDSK utility checks for bad sectors in the hard drive, it also has to create logs of the result. And as states in the error message, the CHKDSK utility is not able to log the logged messages. This kind of error occurs when the log can’t be written to an installation disk. You can find the log in this location, “C:WindowsSystem32LogfilesSrtSrtTrail.txt”. Now you have to check if the drive writable by following these steps:
  • Log in as administrator and right-click on the system drive.
  • Select Properties and then go to the Security tab. Here, check if you are allowed to modify the drive. If not, click on Edit (as an administrator).
  • Now edit the permissions for the SYSTEM and Administrators group. Note that these are the only default settings for these two groups or usernames.
  • Then click on the Apply button save the changes made and exit.

Option 2 – Run the CHKDSK utility in Safe Mode

You could also try to run the CHKDSK utility in Safe Mode as this might solve the error.
  • Boot your computer in Safe Mode.
  • Next, open Command Prompt with admin privileges.
  • Then type and enter this command to execute it: chkdsk c: /f /r
  • Wait until the process is completed and boot your computer normally and then run the CHKDSK utility again and check if the “Failed to transfer logged messages to the log event with status 50” error is now fixed.

Option 3 – Try to check the hard disk or external drive physically

If the first two options didn’t work, you might want to check the physical status of your hard disk or external drive as the problem could root from there. You can try to tighten the wires that connect the hard disk to the motherboard. However, if it doesn’t help, you should seek out assistance from a hardware technician.
Read More
Change date and time inside Windows 11
date and time windows 11Same as Windows 10, Windows 11 also keeps track of date and time using an internet time server. But in a case that you need to change the date or time for any kind of reason here is a guide for that process:
  1. Press ⊞ WINDOWS + I to open settings
  2. Click on Time & Language in Taskbar
  3. Inside Time & Language click on Date & Time
  4. Turn off Set Time Automatically by clicking on the switch next to it
  5. Below find Set the date and time manually and click on Change
  6. Inside, Change Date and Time window use the drop-down menu to set desired date and time
Read More
How to Stop online tracking in Browsers
It is no longer a secret that websites, social media, and other various places on WEB are tracking you and your messages and emails for keywords that they will later use to promote and serve your specific ads linked to those keywords. Altho the process is fully automated it does feel a little forced and uneasy. That is why we are bringing you this article in which we will show you how to stop website tracking in the most popular and used browsers.

SAFARI

Apple’s Safari browser gives you the option to block cross-site tracking. It also has a Privacy Report that displays all the sites and agencies that are gathering information about you. Before blocking these trackers, you may want to review exactly which sites are tracking you online and gathering information about you. Armed with this information, you may decide that cross-site tracking isn’t a huge issue for your particular browsing habits, or you may decide to avoid certain websites entirely. To access Safari’s Privacy Report:
  1. Launch the Safari web browser.
  2. In the toolbar, select Safari > Privacy Report.
  3. Select the Websites tab. This will display information about all the websites that are profiling you.
  4. Select the Trackers tab. This displays a list of all the trackers that are gathering information about you. This includes the companies that created these trackers and the number of times Safari detected these trackers during your browsing sessions.
You can also check how intrusive a particular website is by navigating to the website in question and then selecting the shield icon that appears alongside Safari’s address bar. You can then select Trackers on This Web Page, and Safari will display a list of all the trackers that are active on this particular webpage. Once you’ve seen all the websites and agencies who are tracking you, if you want to block these trackers:
  1. In the Safari toolbar, select Safari > Preferences …
  2. Select the Privacy tab.
  3. Select the following checkbox: Prevent Cross-Site Tracking.
Safari will now prevent these trackers from following you across the World Wide Web.

CHROME

As you’re browsing the web, Chrome can send a request for websites not to collect or track your browsing data. It’s important to note that this is a request, so there’s no guarantee that every website will honor the request. Frustratingly, Chrome doesn’t provide information about the websites that are tracking you online. However, we still recommend enabling this feature, as it can help minimize the number of websites that are tracking your online movements:
  1. In Chrome’s upper-right corner, select the three-dot menu icon, then Settings.
  2. In the menu on the left, select Privacy and security.
  3. Click Cookies and other site data.
  4. Find the Do not track slider and push it into the On position.
Now Chrome will send a Do Not Track request to every website you visit. Since this is only a request, you may want to take additional steps to protect your online privacy. Ghostery is a Chrome extension that enables you to view and block online trackers. After installing Ghostery, you can view all the trackers that are active on a particular website:
  1. Head to the site in question.
  2. Click the Extensions icon in the Chrome toolbar.
  3. Select Ghostery to see a list of all the trackers this extension has detected.
  4. You can block all of these trackers by selecting the Detailed tab and then clicking Restrict site.
Repeat this process for every site you visit.

MOZILLA FIREFOX

Firefox has an Enhanced Tracking Protection feature that can block all the cross-site trackers identified by Disconnect. This feature can also preserve your online privacy by blocking social media trackers, fingerprints, and crypto miners, making this a great all-arounder for the security-conscious Internet user. Enhanced Tracking Protection should be enabled by default. However, you can verify whether it’s active for your particular Firefox installation by navigating to any website. Next, click the little shield icon that appears alongside Firefox’s address bar and you should see a message confirming that Enhanced Tracking Protection is enabled.
If Enhanced Tracking Protection isn’t enabled, we recommend activating it:
  1. In Firefox’s upper-right corner, select the three-line icon, then Preferences.
  2. In the menu on the left, select Privacy & Security.
  3. You can now select either Standard or Strict. Note that Strict may affect the functionality of certain websites, so it’s recommended you opt for Standard unless you specifically require a greater level of protection.
Similar to Chrome, Firefox can send a Do Not Track request. While you’re in the Privacy & Security menu, you may want to consider activating Mozilla’s Do Not Track feature.

OPERA

When you first installed Opera, it gave you the option to block trackers. If you didn’t take Opera up on the offer then, you can start blocking trackers now:
  1. Along the left side of the Opera browser, click the cog icon. This opens Opera’s settings.
  2. In the menu on the left, select Basic.
  3. Find the Block Trackers slider and push it into the On position.
  4. Blocking trackers can impact the functionality of certain websites. If you start noticing strange behavior on a particular website, you may want to add that site to your Exceptions list. By allowing this site to use trackers, you should be able to resolve any issues you’re experiencing.
To make an exception for one or more websites:
  1. Launch Opera’s settings by clicking the little cog icon.
  2. Navigate to Basic > Manage Exceptions.
  3. Click Add and then type the address of the site where you want to permit trackers.
Repeat for all the sites that you want to add to your exceptions list.
Read More
Importing and Exporting WSL distros in Windows
In this post, you will be guided on how to import and export the WSL distros in your Windows 10 computer. WSL, also known as Windows Subsystem for Linux, is a compatibility layer needed to run Linux binary executable in Windows 10, as well as the Windows Server 2019. In case you don’t know, when you reinstall or reset Windows 10, all of its configuration data stored with the WSL distros gets deleted. Going back or restoring the configuration can be quite challenging but worry not for Microsoft has already got this covered as you can now import and export the WSL or Windows Subsystem for Linux distros. There are three aspects that you have to deal with when you import or export WSL distros in your Windows 10 computer, such as importing WSL distro, exporting WSL distro, and uninstalling the imported WSL distros. Before you proceed to the instructions provided below, make sure that all your installed distros are updated via Microsoft Store. Once you have this covered, follow the options below.

Option 1 – Import the WSL distro

  • Type “command prompt” in the Start Search and from the search results, right-click on Command Prompt and then select the “Run as administrator” option.
  • After opening Command Prompt as admin, execute this command: wsl --list –all
  • The command you entered will list all the installed WSL distros on your computer. And now it’s time for you to import a WSL distro by executing this command: wsl --import <Name of the distro> <Fill path to save the backup .tar file>
Note: In the given command above, replace “<Name of the distro>” with the name of the distro you want to import and replace “<Fill the path to save the backup .tar file>” with the location where you want to save the .tar file.

Option 2 – Export the WSL distro

  • Type “command prompt” in the Start Search and from the search results, right-click on Command Prompt and then select the “Run as administrator” option.
  • After opening Command Prompt as admin, execute this command to see the list of all the installed WSL distros in your computer: wsl --list –all
  • After that, execute this command to export a WSL distro: wsl --export <Name of the distro> <Fill path to save the backup .tar file>

Option 3 – Uninstall the imported WSL distro

  • Open Command Prompt with admin privileges.
  • Next, execute this command to view the list of all the installed WSL distros: wsl --list –all
  • After that, execute this command to uninstall an imported WSL distro: wsl --unregister <Name of the distro>
  • Once it’s done, close Command Prompt and restart your computer.
Read More
T-Mobile Hack, 40 Million and more Impacted
T-MobileHacker group recently came up with claims that they have stolen data from 100 million T-Mobile customers. T-Mobile has responded with confirmation it has been compromised and that over 40 million records were stolen, among them are not just present customers, but anyone who has applied for T-Mobile service as well as past accounts.

What has been stolen?

Report from T-Mobile states that stolen records included first and last name, date of birth, social security number, driver’s license & ID information. The company said that it has “no indication that the data contained in the stolen files included any customer financial information, credit card information, debit or other payment information.” Not really a reassuring statement meaning that they really do not know, but even if the statement is true, already stolen information is as much if even not more damaging and devastating as payment information.

What T-Mobile is planning to do now?

It is stated that the hole used for the hack has been addressed and closed so no more data can be stolen. Considering people that had their personal information compromised, T-Mobile said it is planning to reach out to them and offer them two years of free identity protection through McAfee’s ID Theft Protection Service. Additionally, T-Mobile recommends postpaid customers change their PIN by going online into their T-Mobile account or calling T-Mobile customer service by dialing 611 on their phone. The company also recommends a feature called Account Takeover Protection that prevents unauthorized individuals from stealing a phone number and porting it out of T-Mobile. Finally, the company will publish a website “for one-stop information and solutions to help customers take steps to further protect themselves.”
Read More
MS Edge, autoplay video blocking coming
Microsoft Edge may be about to win a lot of fans by introducing a new feature that it says could prevent one of the most annoying things about being online. A new update to the browser suggests it is looking at a way to block auto-playing videos by default when a user navigates to a website. People spotted a new entry to the Microsoft Edge Canary browser where the company tries out its in-progress updates, that suggests auto-playing videos may have had their day at last. The new addition, for Mac, Windows, and Linux systems, is called “Autoplay Limit Default Setting”, with the description suggesting that Microsoft Edge would set the media autoplay setting to "Limit" as a default - stopping videos from starting up when a user lands on a website. Currently, Edge offers two options for users to control media autoplay - "Allow" (the current default setting), where all videos on a website will play automatically with sound, and "Limit", where media won’t be autoplayed on sites that a user has previously visited. It appears that Microsoft is looking to test the feature in Canary before rolling it out to a wider user base - as blocking autoplaying videos can cause issues for some websites. The same Canary entry also hints at a future "Block" option, which would presumably stop any videos or media from playing when a user lands on a website. However, this feature, which is also listed as being available for Mac, Windows, and Linux systems, doesn't appear to be enabled as yet. If you would like to read more helpful articles and tips about various software and hardware visit errortools.com daily.
Read More
Mozilla VPN is here

The new thing from Mozilla is not a browser, it is a VPN!

Besides Firefox, Mozilla offers now Firefox Relay, an app helping you to mask your email and phone number, and a new Mozilla VPN.

mozilla vpn

Mozilla has recently announced a new subscription model that will let you use all products together for $6.99 per month. Although this is a little more expensive than the competition that goes around for $5 per month note that with this subscription you are having access to all services, not just VPN.

VPN will not only hide your IP address but will also make sure websites cannot access your real location and it encrypts all of your network activity. Relay will give you protection against spam, serving as a shield for your email and limiting spammers from access to your real email address and phone number. With Mozilla subscription will let you use both services.

Read More
New Windows 11 keyboard shortcuts
New Windows brings new keyboard shortcuts, most of them are tied to new features and we are presenting you some new ones that are worth remembering. keyboad shortcuts⊞ WINDOWS + N - notification panel ⊞ WINDOWS + W - News and Interests feed With the News and Interests feed, Windows 11 offers users the ability to check the latest news, the weather, and more without opening a browser window. ⊞ WINDOWS + Z - Snap Layout Instead of the usual two windows snapping capability, Windows 11 allow users to snap their windows in a three-column layout. Users can access this by pressing Windows Key and Z to access the Snap layout. ⊞ WINDOWS + PRT SCN - taking screenshots This one isn’t exactly new, but pressing the Windows Key and Print Screen will automatically capture the entire screen and save a copy of the image on your PC. Once the screen flashes, you will know that the screenshot has been taken, after which you can find the file saved under your Pictures folder in a subfolder called Screenshot. ⊞ WINDOWS + C - Microsoft Teams chat Microsoft Teams app, the service allows anyone with a Microsoft account to quickly start a chat using the Windows + C shortcut.
Read More
1 2 3 171
Logo
Copyright © 2023, ErrorTools. All Rights Reserved
Trademark: Microsoft Windows logos are registered trademarks of Microsoft. Disclaimer: ErrorTools.com is not affiliated with Microsoft, nor claims direct affiliation.
The information on this page is provided for information purposes only.
DMCA.com Protection Status