Attacks/Breaches

10/19/2017
09:00 AM
50%
50%

New Locky Ransomware Strain Emerges

Latest version goes by the .asasin extension and is collecting information on users' computer operating system and IP address.

Locky authors have again retooled the highly persistent ransomware campaign with a new strain that performs reconnaissance on victims' computers and goes by a new file extension name, PhishMe reports today.

The latest Locky strain, which began appearing on Oct. 11 and goes by the .asasin extension, is collecting information on users' computers such as the operating system used, IP address, and other such information, says Brendan Griffin, PhishMe threat intelligence manager.

"The information it's collecting is nothing too personally identifiable, but it gives the actors a rough idea of information about the computer, and attackers never do things without a purpose," Griffin observes.

Although the intent of Locky's reconnaissance isn't fully clear, its ability to collect information on infected Windows versions could help its authors determine which OS version is the most susceptible to its attacks, says Griffin.

Collected IP address information, which reveals the geographic location of a computer, is helping to set the stage for a new twist with Locky. Victims are hit with either a Locky ransomware attack or banking Trojan TrickBot, depending on their geographic location.

Locky's Muted Threat

The latest Locky strain uses a .asasin extension, a move that could be designed to intimidate victims into paying the ransom, Griffin surmises. "It could be a muted threat, or a form of new branding to get their name out there again," he notes.

Since Locky first emerged in February 2016, it has undergone nearly a dozen changes to its file extension name with each new strain, Griffin estimates. Some of its previous strains included extensions .ykcol, .lukitus, and .thor, Griffin says.

Despite this most recent name change, Griffin says it is still apparent that this ransomware strain is Locky. Tell-tale signs that Locky continues to lurk within this strain include the way it runs its encryption process to lock down victims' data, the structure of its ransom note, and the payment method it demands of its victims.

"Combine those attributes and behaviors and we're talking about the same animal," says Griffin.

Locky is considered one of the most persistent and destructive ransomware campaigns, due to the prolific ransomware samples its authors churn out. Locky's operators, believed to be a group called Dungeon Spider, work with other actors to distribute the malicious payloads via botnets and cleverly crafted phishing campaigns but over the course of last year law enforcement agencies have disrupted these different distribution mechanisms, says Adam Meyers, vice president of intelligence at CrowdStrike.

While some agencies characterize Locky as launching a wave of periodic forceful attacks and then going dormant, Meyers suspects Locky's authors are rolling out new ransomware variants and allowing Locky to fall into the background until the new experiments don't pan out. Then they bring back the old standby Locky.

In May, for example, the Jaff ransomware family emerged in force but it wasn't until researchers released a decryption tool for Jaff in June that the ransomware went away.

"All of sudden, when that happened, Locky popped up. Jaff may have been a replacement for Locky but when that did not work, Locky returned," Meyers says, noting other similar timing issues with other ransomware variants during Locky's existence that leads him to believe Locky has been ever-present since it emerged in 2016.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
CVE-2018-20727
PUBLISHED: 2019-01-17
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.