Cloud

2/7/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

New Zero-Day Ransomware Evades Microsoft, Google Cloud Malware Detection

Shurl0ckr, a form of Gojdue ransomware, was not detected on SharePoint or Google Drive.

Google Drive and Microsoft Office 365, both of which have built-in malware protection, failed to identify a new form of Gojdue ransomware dubbed Shurl0ckr. The zero-day ransomware evaded most major antivirus platforms: only seven percent of 67 tested tools detected it.

Researchers on the Bitglass Threat Research Team discovered Shurl0ckr during a scan of malware in the cloud. It was confirmed as a form of ransomware-as-a-service by Cylance.

Shurl0ckr works the same way as Satan ransomware. A hacker creates a ransomware payload and distributes it via phishing or drive-by download. The malware encrypts files on disk in the background until the victim pays a Bitcoin ransom. Hackers pay a percentage to the author.

The discovery was part of a broader study on malware in the cloud. Researchers found 44% of businesses they scanned had some form of malware in at least one of their cloud applications. One in three corporate instances of SaaS applications were infected with malware.

Microsoft OneDrive had the highest rate of infection compared with other major SaaS applications, with 55% of instances hit. Google Drive was next-highest at 43%, followed by Box and Dropbox, both of which had a 33% infection rate.

Researchers dug into which file types are most likely to have malware. Script and executable formats were most common at 42%, followed by Office documents (21%), other file formats like text files and images (19%), Windows system files (10%), and compressed formats (8%).

The average business has nearly 450,000 files in the cloud, they report, and 1 in 20,000 contains malware, they report in their findings.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Now, we come here to play Paw-ke Man Go!"
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6497
PUBLISHED: 2019-01-20
Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.
CVE-2018-18908
PUBLISHED: 2019-01-20
The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requ...
CVE-2019-6496
PUBLISHED: 2019-01-20
The ThreadX-based firmware on Marvell Avastar Wi-Fi devices allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of...
CVE-2019-3773
PUBLISHED: 2019-01-18
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2019-3774
PUBLISHED: 2019-01-18
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.