Attacks/Breaches

1/4/2017
07:30 AM
Chris Ensey
Chris Ensey
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Ransomware Has Evolved, And Its Name Is Doxware

The latest form of malware holds computers hostage and compromises the privacy of conversations, photos, and sensitive files.

In recent years, ransomware has become a growing concern for companies in every industry. Between April 2015 and March 2016, the number of individuals affected by ransomware surpassed 2 million — a 17.7% increase from the previous year.

Ransomware attacks function by breaching systems, usually through infected email, and locking important files or networks until the user pays a specified amount of money. According to FBI statistics cited in a Malwarebytes report, hackers gained more than $209 million from ransomware payments in the first three months of 2016, putting ransomware on track to rake in nearly $1 billion this year.

Many companies have figured out that they can avoid paying these ransoms by wiping a system clean, restoring it with backup drives, and going about business without being held hostage. But as a result of increased ransom-avoidance, cybercriminals have created an even more insidious threat. Imagine malware that combines ransomware with a personal data leak: this is what the latest threat, doxware, looks like.

With doxware, hackers hold computers hostage until the victim pays the ransom, similar to ransomware. But doxware takes the attack further by compromising the privacy of conversations, photos, and sensitive files, and threatening to release them publicly unless the ransom is paid. Because of the threatened release, it's harder to avoid paying the ransom, making the attack more profitable for hackers.

In 2014, Sony Pictures suffered an email phishing malware attack that released private conversations between top producers and executives discussing employees, actors, industry competitors, and future film plans, among other sensitive topics. And ransomware attacks have claimed a number of recent victims, especially healthcare systems, including MedStar Health, which suffered a major attack affecting 10 hospitals and more than 250 outpatient centers in March 2016. Combine the data leak of Sony and the ransomware attack on MedStar and you can see the potential fallout from a doxware attack.

Doxware requires strategic, end-to-end planning, which means hackers will target their victims more deliberately. Therefore, malicious players will be more intentional in whom they attack, giving corporate leaders, politicians, celebrities, and other public figures cause for concern.

Looking at the data leaked from Sony, it's easy to imagine the catastrophic effect doxware would have on an executive of any major corporation. Company leaders hold countless conversations over email each day on sensitive topics ranging from product development to competition to internal politics, and if there's a doxware attack, the fallout could be extensive.

Expect Things to Get Worse
The technology behind doxware is still new, but expect the problem to become worse. Recent attacks have been contained to Windows desktop computers and laptops, but this will certainly change. Once the malware can infiltrate mobile devices, the threat will become even more pervasive, with text messages, photos, and data from apps at risk for being leaked.

It's also highly likely that doxware will target more types of files. Workplace emails are currently a big target for hackers. However, a company's internal communications/instant messaging network is also appealing to hackers using doxware, as the messaging network often serves as a platform where both sensitive business discussion and casual conversations take place, potentially exposing both company secrets and personally embarrassing exchanges.

Although doxware is largely still developing, two of its variants have been spotted in action by the Malware Hunter Team, whose Cyber Tracker website monitors phishing sites, botnet control sites, and malware distribution. One of these variants hold files ransom with the threat of release and then steals a victim's passwords. Another mutation, Popcorn Time, takes doxware even further giving victims the option to infect two of their friends with the malware instead of paying the ransom. The attacks give a glimpse at what could come from this damaging new ransomware mutation, and the reality is frightening. 

As the doxware threat evolves and a broader range of devices, users, and data are targeted, it's critical for companies and individuals to always keep data security front of mind.

Related Content:

Christopher Ensey is Chief Operating Officer of Dunbar Security Solutions, where he oversees operations across the entire spectrum of the division's managed services. With over 15 years of experience in systems engineering and digital security, he has provided strategic ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
J@wn
50%
50%
[email protected],
User Rank: Apprentice
1/4/2017 | 3:31:35 PM
Inevitable Response
This is the persistent race condition of crime and security, but with an exponential consequence. Paying an expensive ransome is bad enough, but this could easily destroy a business if it's core competency or even competitive advantage was exposed.
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/4/2017 | 10:19:32 AM
Next Mobile Ransomrware Variants
I wouldn't be surprised to see more in terms of mobile ransomware variants that lock up the user's cloud storage resources leveraging the smartphone's authentication features.
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19279
PUBLISHED: 2018-11-14
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVE-2018-19280
PUBLISHED: 2018-11-14
Centreon 3.4.x has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19281
PUBLISHED: 2018-11-14
Centreon 3.4.x allows SNMP trap SQL Injection.
CVE-2018-17960
PUBLISHED: 2018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-19278
PUBLISHED: 2018-11-14
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed lengt...