Threat actors behind the relatively new Venus Ransomware are hacking into publicly-exposed Remote Desktop services to encrypt Windows devices.
Venus Ransomware appears to have begun operating in the middle of August 2022 and has since encrypted victims worldwide. However, there was another ransomware using the same encrypted file extension since 2021, but it is unclear if they are related.
When executed, the Venus ransomware will attempt to terminate thirty-nine processes associated with database servers and Microsoft Office applications. The ransomware will also delete event logs, Shadow Copy Volumes, and disable Data Execution Prevention. When encrypting files, the ransomware will append the .venus extension.
https://www.malwarebytes.com/blog/news/2022/10/venus-ransomware-targets-remote-desktop-services