Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/25/2016
03:00 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
50%
50%

7 Scary Ransomware Families

Here are seven ransomware variants that can creep up on you.
Previous
1 of 8
Next

Image Source: Trend Micro

Image Source: Trend Micro

As the season of evil witches, ghosts, goblins, and ghouls approaches, it’s time to be on guard. But security managers face scary prospects year-round, especially as new strains of ransomware escalate. And ransomware variants are getting more pervasive - and creepier - than ever. 

The FBI says that from Jan. 1, 2016 to June 30, 1,308 ransomware complaints have been reported, totaling $2,685,274 in losses. 

And it appears that the ransomware “business” will continue to grow for cybercriminals. Ed Cabrera, chief cybersecurity officer at Trend Micro, says his research team tracked 29 ransomware families last year, and this year is on pace to track well more than 100 variants.

"These ransomware attacks are much different than traditional data breaches in that they go right after the victim," Cabrera says. "It's not like in the past where data was exfiltrated and sold to other criminals."

Most of these ransomware variants encrypt a person’s machine and try to extract a ransom, typically several hundred dollars. What keeps security managers up at night is that ransomware has made its way to the enterprise. The $17,000 ransom paid by Hollywood Presbyterian Hospital earlier this year is of particular note. But new variants attack entire databases and servers – and they now use familiar chat features to make it easier for the victims to pay the ransom.

As a cautionary tale for the season, here are seven of the scariest ransomware variants. This list is based on a consensus drawn from interviews with Trend Micro's Cabrera; Chris Day, CISO of Invincea; and Bryan Lee, threat intel analyst for Unit 42 at Palo Alto Networks.

 

 

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
jamie55
50%
50%
jamie55,
User Rank: Apprentice
10/26/2016 | 3:55:30 AM
candid photographer
Excellent blog here! Also your site loads up fast.

Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
10/26/2016 | 8:57:55 AM
Jigsaw
Jigsaw's scheme is particularly brilliant because, ultimately, the point of all this is less to harass and more to get victims to pay.  Helping victims figure out how to do that and coax them along helpfully (particularly as many victims may not even know how to purchase Bitcoins) is ultimately a key component of that "business plan."

One (of many) especially sad thing here is that legitimate companies could learn a lot from this model.
ChandanaP946
50%
50%
ChandanaP946,
User Rank: Strategist
10/26/2016 | 9:21:53 AM
Re: Jigsaw
As companies grow aware of the threat of ransomware, threat actors are upping the ante with "doxware" by implementing features to ransomware that could leak a victim's data if ransoms aren't paid. https://cyware.com/news/ransomware-evolving-into-doxware-to-scare-victims-into-paying-say-researchers-eb443f2b
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
10/26/2016 | 3:08:27 PM
Ransomware; new industry
I could not believe that there has been a new instruct created out of cyber-attacks. We are not in the right track at all.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
10/26/2016 | 3:09:30 PM
Re: candid photographer
" ... Excellent blog  ...":

Agree. Good information.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
10/26/2016 | 3:12:32 PM
Re: Jigsaw
"... Jigsaw's scheme is particularly brilliant  ..."

there might be better ways but it is impressive.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
10/26/2016 | 3:14:54 PM
Re: Jigsaw
"... As companies grow aware of the threat of ransomware ..."

I say they are not. It looks like companies are willing to pay to get the data back instead of investing a good backup system.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
10/26/2016 | 3:17:20 PM
Re: Jigsaw
"... doxware ..."

I was reading about this the other day, obviously when the victim does not pay for the old files hackers still want to get someting out of it. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/27/2016 | 12:11:24 PM
Re: Ransomware; new industry
@Dr.T: A big contributing factor to why this "industry" developed has to do with spam.  After the huge spam crackdown a few years ago, black-hatters had these botnets and malware under their control...but spamming was no longer particularly profitable or worth the risk for them.  Accordingly, they had to come up with new business models.

Enter ransomware.

Ironically enough, if we had left the spammers alone, we might not have seen this particular "innovation."
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/27/2016 | 12:12:27 PM
Re: Jigsaw
@Dr.T: On top of that, it's a way for them to "double-dip."  First, pay up to get your data back.  Next, pay up so that no one else gets it.
Page 1 / 2   >   >>
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-40690
PUBLISHED: 2021-09-19
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract...
CVE-2021-41073
PUBLISHED: 2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVE-2021-23441
PUBLISHED: 2021-09-19
All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVE-2021-41394
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.