06:35 PM
Connect Directly

Ransomware Spikes, Tries New Tricks

Ransomware authors constantly upping their game, techniques, to stay ahead of security researchers.

The quick money to be made in ransomware scams appears to be driving furious innovation in the cybercrime world.

Over the last several months, security researchers have reported seeing malware authors constantly employing new tricks, tools, and techniques to snag victims and stay ahead of security researchers.

A flurry of reports this week shows there’s no sign of the trend slowing down any time soon.

Locky Locks Down

The authors of Locky, one of the most prolific ransomware samples currently in circulation, have gone into full defensive mode. In a report released this week, German security firm Avira Operations said that the group behind Locky had begun using public key encryption to protect communication between victims and the command and control servers that are being used to manage the malware.

In addition to a specific public key for encrypting data on a victim’s computer, Locky now includes an RSA public key to encrypt C&C communications, Avira said in a blog post today. The change makes it much harder for security researchers to eavesdrop on the malware’s activities.

“Previously researchers have been able to sinkhole the domains of Locky’s DGA (domain-name generation algorithm) and provide statistics on infections and activities,” the Avira alert noted.

Researchers will still be able to get IP addresses of victims and know where they are located geographically using a sinkhole. But the change makes it impossible for researchers to collect information, like size of the victim, the ransom amounts demands, the type of infected operation system, and other details, Avira said.

It is likely that the encryption is a pre-emptive move by Locky’s authors to prevent other cybercriminals from making knock-offs of the malware, Avira security researcher Moritz Kroll said in the blog post.

In separate but related news, a new report from Proofpoint summarizing the threat landscape in the first quarter of 2016 showed that 24% of all email attacks involving malicious attachments featured Locky. The only other e-mailed based malware sample that was more prevalent in the first quarter was Dridex, a banking Trojan that is beginning to be used increasingly in ransomware attacks as well.

Brute Force Remote Desktop Protocol Attacks

Netherlands-based security consultancy Fox-IT Monday said its researchers had observed an uptick in the use of compromised remote desktop servers to activate ransomware on victim computers.

Unlike typical ransomware infections, which involve the use of malicious email attachments in spam and phishing emails, some threat actors have begun going after Internet-connected remote desktop servers belonging to enterprises.

In an alert, Fox-IT senior forensic IT expert Wouter Jansen said the company had investigated several recent incidents where threat actors had used brute-force attacks on enterprise remote desktop servers in a bid to break into them. Such access typically gives attackers the ability to search for and find a lot more servers and data to encrypt than other methods, Jansen warned.

“As the attackers have a lot of knowledge of the compromised network and company, their position in the negotiation is stronger than when infection took place through a drive-by download or infected e-mail attachment,” Jansen said. “The demanded ransom reflects this and could be significantly higher,” the security researcher warned.

More Personalized and Professional

Ransomware authors are getting more creative about how they target victims, Trend Micro said in a report released Monday. Some have begun using macros and scripts, displaying professional-looking phishing pages, adding new functions, and modifying a computer’s master boot record to get victims to activate the malware on their systems, the security vendor said.

As examples, Trend Micro pointed to Maktublocker, a ransomware sample that targets victims with emails containing their full and correct names and mailing addresses and Cerber, a ransomware tool that features a voice capability to try and convince users to activate it. Some tools appear to be getting user-friendly as well. One example is TrueCrypter that demands its ransom in the form of an Amazon gift card, Trend Micro said.

Meanwhile, ransomware infections continue to go through the roof. Anti-spyware vendor Enigma Software on Monday released a report showing that April was the worst month on record for ransomware in the US. According to the company, the number of ransomware samples detected by its product jumped over 158% between February and March of this year alone.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
5/3/2016 | 7:33:46 AM
Business focus
As much as it might seem like an unfair stance to take, I hope ransomeware continues to target enterprises more. Not only are they less likely to be personally - although financially - affected, but they are more likely to have insurance in place to cover potential losses. 

It could also encourage better security of data at these companies.

When consumers are targeted though, it's emotional damage that's mostly done through a loss of images and personal files. That's far more nefarious.
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-02-16
Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter.
PUBLISHED: 2019-02-16
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
PUBLISHED: 2019-02-16
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, o...
PUBLISHED: 2019-02-16
Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value.
PUBLISHED: 2019-02-16
In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.