Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/4/2017
07:30 AM
Chris Ensey
Chris Ensey
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Ransomware Has Evolved, And Its Name Is Doxware

The latest form of malware holds computers hostage and compromises the privacy of conversations, photos, and sensitive files.

In recent years, ransomware has become a growing concern for companies in every industry. Between April 2015 and March 2016, the number of individuals affected by ransomware surpassed 2 million — a 17.7% increase from the previous year.

Ransomware attacks function by breaching systems, usually through infected email, and locking important files or networks until the user pays a specified amount of money. According to FBI statistics cited in a Malwarebytes report, hackers gained more than $209 million from ransomware payments in the first three months of 2016, putting ransomware on track to rake in nearly $1 billion this year.

Many companies have figured out that they can avoid paying these ransoms by wiping a system clean, restoring it with backup drives, and going about business without being held hostage. But as a result of increased ransom-avoidance, cybercriminals have created an even more insidious threat. Imagine malware that combines ransomware with a personal data leak: this is what the latest threat, doxware, looks like.

With doxware, hackers hold computers hostage until the victim pays the ransom, similar to ransomware. But doxware takes the attack further by compromising the privacy of conversations, photos, and sensitive files, and threatening to release them publicly unless the ransom is paid. Because of the threatened release, it's harder to avoid paying the ransom, making the attack more profitable for hackers.

In 2014, Sony Pictures suffered an email phishing malware attack that released private conversations between top producers and executives discussing employees, actors, industry competitors, and future film plans, among other sensitive topics. And ransomware attacks have claimed a number of recent victims, especially healthcare systems, including MedStar Health, which suffered a major attack affecting 10 hospitals and more than 250 outpatient centers in March 2016. Combine the data leak of Sony and the ransomware attack on MedStar and you can see the potential fallout from a doxware attack.

Doxware requires strategic, end-to-end planning, which means hackers will target their victims more deliberately. Therefore, malicious players will be more intentional in whom they attack, giving corporate leaders, politicians, celebrities, and other public figures cause for concern.

Looking at the data leaked from Sony, it's easy to imagine the catastrophic effect doxware would have on an executive of any major corporation. Company leaders hold countless conversations over email each day on sensitive topics ranging from product development to competition to internal politics, and if there's a doxware attack, the fallout could be extensive.

Expect Things to Get Worse
The technology behind doxware is still new, but expect the problem to become worse. Recent attacks have been contained to Windows desktop computers and laptops, but this will certainly change. Once the malware can infiltrate mobile devices, the threat will become even more pervasive, with text messages, photos, and data from apps at risk for being leaked.

It's also highly likely that doxware will target more types of files. Workplace emails are currently a big target for hackers. However, a company's internal communications/instant messaging network is also appealing to hackers using doxware, as the messaging network often serves as a platform where both sensitive business discussion and casual conversations take place, potentially exposing both company secrets and personally embarrassing exchanges.

Although doxware is largely still developing, two of its variants have been spotted in action by the Malware Hunter Team, whose Cyber Tracker website monitors phishing sites, botnet control sites, and malware distribution. One of these variants hold files ransom with the threat of release and then steals a victim's passwords. Another mutation, Popcorn Time, takes doxware even further giving victims the option to infect two of their friends with the malware instead of paying the ransom. The attacks give a glimpse at what could come from this damaging new ransomware mutation, and the reality is frightening. 

As the doxware threat evolves and a broader range of devices, users, and data are targeted, it's critical for companies and individuals to always keep data security front of mind.

Related Content:

Christopher Ensey is Chief Operating Officer of Dunbar Security Solutions, where he oversees operations across the entire spectrum of the division's managed services. With over 15 years of experience in systems engineering and digital security, he has provided strategic ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
J@wn
50%
50%
[email protected],
User Rank: Apprentice
1/4/2017 | 3:31:35 PM
Inevitable Response
This is the persistent race condition of crime and security, but with an exponential consequence. Paying an expensive ransome is bad enough, but this could easily destroy a business if it's core competency or even competitive advantage was exposed.
HardenStance
50%
50%
HardenStance,
User Rank: Strategist
1/4/2017 | 10:19:32 AM
Next Mobile Ransomrware Variants
I wouldn't be surprised to see more in terms of mobile ransomware variants that lock up the user's cloud storage resources leveraging the smartphone's authentication features.
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4245
PUBLISHED: 2019-12-11
Orca has arbitrary code execution due to insecure Python module load
CVE-2013-4593
PUBLISHED: 2019-12-11
RubyGem omniauth-facebook has an access token security vulnerability
CVE-2013-6495
PUBLISHED: 2019-12-11
JBossWeb Bayeux has reflected XSS
CVE-2013-7370
PUBLISHED: 2019-12-11
node-connect before 2.8.2 has cross site scripting in methodOverride Middleware
CVE-2019-18935
PUBLISHED: 2019-12-11
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote cod...