Endpoint

5/2/2016
06:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Spikes, Tries New Tricks

Ransomware authors constantly upping their game, techniques, to stay ahead of security researchers.

The quick money to be made in ransomware scams appears to be driving furious innovation in the cybercrime world.

Over the last several months, security researchers have reported seeing malware authors constantly employing new tricks, tools, and techniques to snag victims and stay ahead of security researchers.

A flurry of reports this week shows there’s no sign of the trend slowing down any time soon.

Locky Locks Down

The authors of Locky, one of the most prolific ransomware samples currently in circulation, have gone into full defensive mode. In a report released this week, German security firm Avira Operations said that the group behind Locky had begun using public key encryption to protect communication between victims and the command and control servers that are being used to manage the malware.

In addition to a specific public key for encrypting data on a victim’s computer, Locky now includes an RSA public key to encrypt C&C communications, Avira said in a blog post today. The change makes it much harder for security researchers to eavesdrop on the malware’s activities.

“Previously researchers have been able to sinkhole the domains of Locky’s DGA (domain-name generation algorithm) and provide statistics on infections and activities,” the Avira alert noted.

Researchers will still be able to get IP addresses of victims and know where they are located geographically using a sinkhole. But the change makes it impossible for researchers to collect information, like size of the victim, the ransom amounts demands, the type of infected operation system, and other details, Avira said.

It is likely that the encryption is a pre-emptive move by Locky’s authors to prevent other cybercriminals from making knock-offs of the malware, Avira security researcher Moritz Kroll said in the blog post.

In separate but related news, a new report from Proofpoint summarizing the threat landscape in the first quarter of 2016 showed that 24% of all email attacks involving malicious attachments featured Locky. The only other e-mailed based malware sample that was more prevalent in the first quarter was Dridex, a banking Trojan that is beginning to be used increasingly in ransomware attacks as well.

Brute Force Remote Desktop Protocol Attacks

Netherlands-based security consultancy Fox-IT Monday said its researchers had observed an uptick in the use of compromised remote desktop servers to activate ransomware on victim computers.

Unlike typical ransomware infections, which involve the use of malicious email attachments in spam and phishing emails, some threat actors have begun going after Internet-connected remote desktop servers belonging to enterprises.

In an alert, Fox-IT senior forensic IT expert Wouter Jansen said the company had investigated several recent incidents where threat actors had used brute-force attacks on enterprise remote desktop servers in a bid to break into them. Such access typically gives attackers the ability to search for and find a lot more servers and data to encrypt than other methods, Jansen warned.

“As the attackers have a lot of knowledge of the compromised network and company, their position in the negotiation is stronger than when infection took place through a drive-by download or infected e-mail attachment,” Jansen said. “The demanded ransom reflects this and could be significantly higher,” the security researcher warned.

More Personalized and Professional

Ransomware authors are getting more creative about how they target victims, Trend Micro said in a report released Monday. Some have begun using macros and scripts, displaying professional-looking phishing pages, adding new functions, and modifying a computer’s master boot record to get victims to activate the malware on their systems, the security vendor said.

As examples, Trend Micro pointed to Maktublocker, a ransomware sample that targets victims with emails containing their full and correct names and mailing addresses and Cerber, a ransomware tool that features a voice capability to try and convince users to activate it. Some tools appear to be getting user-friendly as well. One example is TrueCrypter that demands its ransom in the form of an Amazon gift card, Trend Micro said.

Meanwhile, ransomware infections continue to go through the roof. Anti-spyware vendor Enigma Software on Monday released a report showing that April was the worst month on record for ransomware in the US. According to the company, the number of ransomware samples detected by its product jumped over 158% between February and March of this year alone.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
5/3/2016 | 7:33:46 AM
Business focus
As much as it might seem like an unfair stance to take, I hope ransomeware continues to target enterprises more. Not only are they less likely to be personally - although financially - affected, but they are more likely to have insurance in place to cover potential losses. 

It could also encourage better security of data at these companies.

When consumers are targeted though, it's emotional damage that's mostly done through a loss of images and personal files. That's far more nefarious.
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Cyberspace is much less secure than my old lamp.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6681
PUBLISHED: 2018-07-17
Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.
CVE-2018-13864
PUBLISHED: 2018-07-17
A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.
CVE-2018-14338
PUBLISHED: 2018-07-17
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
CVE-2018-14337
PUBLISHED: 2018-07-17
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
CVE-2018-14329
PUBLISHED: 2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.