Endpoint

10/25/2016
03:00 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
50%
50%

7 Scary Ransomware Families

Here are seven ransomware variants that can creep up on you.
Previous
1 of 8
Next

Image Source: Trend Micro

Image Source: Trend Micro

As the season of evil witches, ghosts, goblins, and ghouls approaches, it’s time to be on guard. But security managers face scary prospects year-round, especially as new strains of ransomware escalate. And ransomware variants are getting more pervasive - and creepier - than ever. 

The FBI says that from Jan. 1, 2016 to June 30, 1,308 ransomware complaints have been reported, totaling $2,685,274 in losses. 

And it appears that the ransomware “business” will continue to grow for cybercriminals. Ed Cabrera, chief cybersecurity officer at Trend Micro, says his research team tracked 29 ransomware families last year, and this year is on pace to track well more than 100 variants.

"These ransomware attacks are much different than traditional data breaches in that they go right after the victim," Cabrera says. "It's not like in the past where data was exfiltrated and sold to other criminals."

Most of these ransomware variants encrypt a person’s machine and try to extract a ransom, typically several hundred dollars. What keeps security managers up at night is that ransomware has made its way to the enterprise. The $17,000 ransom paid by Hollywood Presbyterian Hospital earlier this year is of particular note. But new variants attack entire databases and servers – and they now use familiar chat features to make it easier for the victims to pay the ransom.

As a cautionary tale for the season, here are seven of the scariest ransomware variants. This list is based on a consensus drawn from interviews with Trend Micro's Cabrera; Chris Day, CISO of Invincea; and Bryan Lee, threat intel analyst for Unit 42 at Palo Alto Networks.

 

 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
ChandanaP946
50%
50%
ChandanaP946,
User Rank: Apprentice
10/26/2016 | 9:21:53 AM
Re: Jigsaw
As companies grow aware of the threat of ransomware, threat actors are upping the ante with "doxware" by implementing features to ransomware that could leak a victim's data if ransoms aren't paid. https://cyware.com/news/ransomware-evolving-into-doxware-to-scare-victims-into-paying-say-researchers-eb443f2b
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
10/26/2016 | 8:57:55 AM
Jigsaw
Jigsaw's scheme is particularly brilliant because, ultimately, the point of all this is less to harass and more to get victims to pay.  Helping victims figure out how to do that and coax them along helpfully (particularly as many victims may not even know how to purchase Bitcoins) is ultimately a key component of that "business plan."

One (of many) especially sad thing here is that legitimate companies could learn a lot from this model.
jamie55
50%
50%
jamie55,
User Rank: Apprentice
10/26/2016 | 3:55:30 AM
candid photographer
Excellent blog here! Also your site loads up fast.

<<   <   Page 2 / 2
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-17158
PUBLISHED: 2018-05-24
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prag...
CVE-2017-17315
PUBLISHED: 2018-05-24
Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCCP m...
CVE-2018-5485
PUBLISHED: 2018-05-24
NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack.
CVE-2018-5487
PUBLISHED: 2018-05-24
NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
CVE-2018-7902
PUBLISHED: 2018-05-24
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privile...