Bitdefender Labs is the security vendor's research blog, with malware analyses, ransomware, botnets, backdoors, and device vulnerabilities.
HN links it for ransomware and malware analysis, such as the Linux ransomware with a predictable key and a DarkSide decryption tool. One commenter called an article fairly competent despite its clickbait title.
It is worth noting that the 8.3 short name of the hidden file was HUB001.DAT[1]. This is because VFAT allows the specification of both a short name (8.3) and long name (LFN) for each file/directory.
You can find 8.3 '.' entry names by searching a partition for \x2e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
A file with an LFN of '.' could be found with (hopefully this is correct) \x00\x2e\x00\x00\x00\x00\xff\xff\xff\xff\x0f
It appears as if 8.3 file names starting with '.' are treated specially but LFNs starting with '.' carry no significant meaning.
I struggled to find references to other malware that has used a similar approach. Does anyone have more information?
Surely Windows does not attempt to automatically execute files with a LFN (UTF-16 name) of '.'?
[1] http://labs.bitdefender.com/2012/06/flame-the-story-of-leaked-data-carried-by-human-vector/
[2] https://en.wikipedia.org/wiki/File_Allocation_Table#Directory_entry
Previously: https://news.ycombinator.com/item?id=10524791
tl;dr: if you run nearly-a-year-unpatched software (Magento) you will be hacked by script kiddies.
This is a fairly competent article, other than the obviously click-bait title. Although the Bitdefender post linked as a source contains much more technical detail and less copy-paste tutorial: http://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/
It seems like some variant of the Linux.Encoder.1 (2015):
http://www.zdnet.com/article/crypto-ransomware-strikes-linux-but-attackers-botch-private-key/
https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/
probably "python based" and, as mentioned on the gentoo forums, the ransomware mesage is very similar to the one in:
https://github.com/jdsecurity/CryptoTrooper
* There exists a decryption tool for DarkSide
https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/
* Critical infrastructure should not be allowed to run on Microsoft Windows
* The remote workers, through which the attack was performed, didn't even use a VPN, just TeamViewer and MS Remote Desktop.
This seems to be source for the article: https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the-complex-zacinlo-ad-fraud-operation/ (there is a PDF linked), no mention of surviving a format or clean reinstall.