Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/28/2017
06:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Locky Ransomware Phishing Attacks Beat Machine Learning Tools

Late September attacks highlight the persistent nature of ransomware threats, Comodo says.

The Locky ransomware strain, initially spotted in February 2016, has emerged as one of the most dangerous examples of the highly persistent and pernicious nature of modern cyber extortion campaigns.

The operators of the malware—among the most prolific ransomware samples ever—have shown a tendency to launch brief waves of attacks, go dormant for some time and then come back with a vengeance to torment businesses and consumers.

The most recent of those waves happened in late September and appeared targeted at businesses in multiple regions including North America, Europe and Southeast Asia, security vendor Comodo said in a soon-to-be-published special report.

Comodo described the September Locky campaign as building on two previous attack waves that the vendor reported on last month (here & here). As with the earlier attacks, the latest ones too used a botnet of zombie computers distributed around the word to send highly convincing looking phishing emails to potential victims.

One of the emails used in the phishing campaign was designed to appear like a scanned document from a business printer located at the victim's organization. To lend credibility, the phishing email included a model number for a very popular Konica Minolta scanner/printer widely deployed in businesses around the world.

A second email used in the phishing campaign was spoofed to appear like a query pertaining to the status of a vendor invoice. Recipients, who were lured into opening the attachments in these emails, downloaded Locky on their systems. The average ransom amount for the decryption key tended to range between $2,000 and $4,000.

The social engineering that was used to engage victims was carefully designed to slip past malware detection tools including those using machine-learning algorithms to spot phishing emails, says Fatih Orhan, vice president, threat labs at Comodo.

The attachment in one of the emails for instance was disguised as a printer output, and it contained a script inside an archive file. "This is not enough to make a phishing detection," Orhan says.

"Machine learning algorithms need to extract the attachment, open the archive, extract the script and understand it has a malicious intent," he notes. "Usually, these scripts contain just a download component and do not have malicious intent on their own. That’s why even machine learning is not sufficient in making these kinds of detections."

Additional measures are needed to run the script dynamically and to download the actual payload, and conduct malware analysis to detect phishing, Orhan explains.

Security researchers at Comodo detected and analyzed over 110,000 Locky-related emails at customer endpoints over a three-day period between Sept. 17 and Sept. 20.

The phishing emails that purported to be printer output were sent from a total of nearly 120,000 IP addresses from 139 country code top-level domains, according to Comodo. The other phishing email that was utilized in the September Locky campaign was sent from over 12,350 IP addresses in 142 countries. In total, the IP addresses used in the September attacks were scattered across more than half of all countries in the world.

Many of the IP addresses belonged to infected computers belonging to individual consumers. But there were a fair number of systems belonging to ISPs as well, Orhan says.

Significantly, a considerable number of servers used to spread the phishing email were the same as ones used in previous campaigns. "These are mostly compromised servers as we understand," Orhan said. "The fact that they are used for multiple attacks shows there is no remediation on these servers."

Many ISPs also do not appear to have controls for spotting infected systems belonging to their customers that are being used to continuously send phishing emails over weeks.  "It's possible they don’t have real-time detection capabilities. But the attacks being continuous over weeks, shows they are incompetent in securing the network traffic they are providing," Orhan says.

Locky was one of the most widely distributed ransomware tools in 2016 and looks set to be among the most widely distributed pieces of malware this year as well. One of its most notable victims—at least publicly disclosed ones—is Hollywood Presbyterian Medical Center, which was forced to pay $17,000 to retrieve a critical database that was encrypted with the malware.

News about the latest Locky attacks comes even as Europol this week warned of ransomware eclipsing all other forms of cyber threat for the second year in a row.

"Ransomware attacks have eclipsed most other global cybercrime threats, with the first half of 2017 witnessing ransomware attacks on a scale previously unseen following the emergence of self-propagating ‘ransomworms,' " Europol said citing examples like WannaCry and Petya/NotPetya outbreaks.

Related content:

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Ritu_G
50%
50%
Ritu_G,
User Rank: Moderator
8/19/2018 | 11:36:02 PM
hi
This is very worrying especially when we usually think of scam scares as trivial or non-threatening at all. Just look at the fatality of their impact on hardwares and we know for sure how much caution we need to take before we are hit. We are constantly advised to update our system even if it means spending an awful lot of time to ensure a system update. Prevention is always better than cure and when it comes to technology, it is to also safeguard ourselves against a hefty amount of potential damage costs.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17789
PUBLISHED: 2019-09-20
Prospecta Master Data Online (MDO) allows CSRF.
CVE-2019-11280
PUBLISHED: 2019-09-20
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain ...
CVE-2019-11326
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same pro...
CVE-2019-11327
PUBLISHED: 2019-09-20
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system.
CVE-2019-14814
PUBLISHED: 2019-09-20
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly execute arbitrary code.