06:35 PM
Connect Directly

Ransomware Spikes, Tries New Tricks

Ransomware authors constantly upping their game, techniques, to stay ahead of security researchers.

The quick money to be made in ransomware scams appears to be driving furious innovation in the cybercrime world.

Over the last several months, security researchers have reported seeing malware authors constantly employing new tricks, tools, and techniques to snag victims and stay ahead of security researchers.

A flurry of reports this week shows there’s no sign of the trend slowing down any time soon.

Locky Locks Down

The authors of Locky, one of the most prolific ransomware samples currently in circulation, have gone into full defensive mode. In a report released this week, German security firm Avira Operations said that the group behind Locky had begun using public key encryption to protect communication between victims and the command and control servers that are being used to manage the malware.

In addition to a specific public key for encrypting data on a victim’s computer, Locky now includes an RSA public key to encrypt C&C communications, Avira said in a blog post today. The change makes it much harder for security researchers to eavesdrop on the malware’s activities.

“Previously researchers have been able to sinkhole the domains of Locky’s DGA (domain-name generation algorithm) and provide statistics on infections and activities,” the Avira alert noted.

Researchers will still be able to get IP addresses of victims and know where they are located geographically using a sinkhole. But the change makes it impossible for researchers to collect information, like size of the victim, the ransom amounts demands, the type of infected operation system, and other details, Avira said.

It is likely that the encryption is a pre-emptive move by Locky’s authors to prevent other cybercriminals from making knock-offs of the malware, Avira security researcher Moritz Kroll said in the blog post.

In separate but related news, a new report from Proofpoint summarizing the threat landscape in the first quarter of 2016 showed that 24% of all email attacks involving malicious attachments featured Locky. The only other e-mailed based malware sample that was more prevalent in the first quarter was Dridex, a banking Trojan that is beginning to be used increasingly in ransomware attacks as well.

Brute Force Remote Desktop Protocol Attacks

Netherlands-based security consultancy Fox-IT Monday said its researchers had observed an uptick in the use of compromised remote desktop servers to activate ransomware on victim computers.

Unlike typical ransomware infections, which involve the use of malicious email attachments in spam and phishing emails, some threat actors have begun going after Internet-connected remote desktop servers belonging to enterprises.

In an alert, Fox-IT senior forensic IT expert Wouter Jansen said the company had investigated several recent incidents where threat actors had used brute-force attacks on enterprise remote desktop servers in a bid to break into them. Such access typically gives attackers the ability to search for and find a lot more servers and data to encrypt than other methods, Jansen warned.

“As the attackers have a lot of knowledge of the compromised network and company, their position in the negotiation is stronger than when infection took place through a drive-by download or infected e-mail attachment,” Jansen said. “The demanded ransom reflects this and could be significantly higher,” the security researcher warned.

More Personalized and Professional

Ransomware authors are getting more creative about how they target victims, Trend Micro said in a report released Monday. Some have begun using macros and scripts, displaying professional-looking phishing pages, adding new functions, and modifying a computer’s master boot record to get victims to activate the malware on their systems, the security vendor said.

As examples, Trend Micro pointed to Maktublocker, a ransomware sample that targets victims with emails containing their full and correct names and mailing addresses and Cerber, a ransomware tool that features a voice capability to try and convince users to activate it. Some tools appear to be getting user-friendly as well. One example is TrueCrypter that demands its ransom in the form of an Amazon gift card, Trend Micro said.

Meanwhile, ransomware infections continue to go through the roof. Anti-spyware vendor Enigma Software on Monday released a report showing that April was the worst month on record for ransomware in the US. According to the company, the number of ransomware samples detected by its product jumped over 158% between February and March of this year alone.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
5/3/2016 | 7:33:46 AM
Business focus
As much as it might seem like an unfair stance to take, I hope ransomeware continues to target enterprises more. Not only are they less likely to be personally - although financially - affected, but they are more likely to have insurance in place to cover potential losses. 

It could also encourage better security of data at these companies.

When consumers are targeted though, it's emotional damage that's mostly done through a loss of images and personal files. That's far more nefarious.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-09-21
FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action, io_in_iface, io_in_set, io_in_ip, io_in_mask, io_in_gw, io_out_iface, io_out_set, io_out_mask, io_out_gw, iface, or domain parameter to /ww...
PUBLISHED: 2018-09-21
An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action.
PUBLISHED: 2018-09-21
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
PUBLISHED: 2018-09-21
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
PUBLISHED: 2018-09-21
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.