Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/24/2016
05:25 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Attackers Clobbering Victims With One-Two Punch Of Ransomware And DDoS

Encrypted systems now being added to botnets in the latest incarnations of ransomware attacks, with experts expecting this to become standard practice.

As if ransomware weren't bad enough, attackers are now making the most of their attacks by adding victimized machines to distributed denial of service (DDoS) botnets at the same time that they're encrypted and held hostage, according to warnings from several security research organizations in the last week.

This one-two punch is a natural gimme for profit-minded attackers and one which security pundits expect will be standard issue for most ransomware kits in the near future.

"Adding DDoS capabilities to ransomware is one of those 'evil genius' ideas," says Stu Sjouwerman, CEO of KnowBe4, which today issued an alert that a new variant of Cerber ransomware has added DDoS capabilities to its payloads. "Renting out DDoS botnets on the Dark Web is a very lucrative business, even if prices have gone down in recent years. You can expect [bundling] it to become a fast-growing trend.”

The new trend was first detailed by researchers with Invincea last week, which found attackers using weaponized Office documents to deliver the threat via a Visual Basic exploit that allows them to conduct a file-less attack. That delivers malware with the underlying binary, giving the bad guys "two attacks for the price of one," says Ikenna Dike of Invincea. 

"First, it is a typical ransomware binary that encrypts the user’s file system and files while displaying a ransom note. Second, the binary could also be used to carry out a DDoS attack," Dike said in a post. "The observed network traffic looks to be flooding the subnet with UDP packets over port 6892. By spoofing the source address, the host could direct all response traffic from the subnet to a targeted host, causing the host to be unresponsive."

Seen by many as a perfect example of the mercenary nature of cybercrime, ransomware's evolution has been driven entirely by black market ROI. According to the FBI, by the end of the year the ransomware market is expected to net the crooks at least $1 billion.

"Relatively high profit margins coupled with the relatively low overhead required to operate a ransomware campaign have bolstered the appeal of this particular attack type, fueling market demand for tools and services corresponding to its propagation," explained FireEye researchers in an update last week on ransomware activity.

FireEye's data shows that there was a noticeable spike in ransomware in March this year and that overall figures are on track for ransomware to exceed 2015 levels. This latest trend of DDoS bundling once again shows the lengths to which the criminals will squeeze every last bit of profitability and efficiency from ransomware attacks. It also offers fair warning to enterprises that even with backups, ransomware can pose threats to their endpoints and networks at large.

Even if data is restored on systems plagued by ransomware, there's no guarantee that a system wouldn't be used to continue to remain a part of the botnet or be used as a foothold for further attacks if the threat isn't properly contained.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
hewenthatway
50%
50%
hewenthatway,
User Rank: Strategist
5/29/2016 | 5:48:46 AM
ima stick with canada here
We should never pay ransoms because kidnapping/ransomware is a self fulfilling prophecy
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/27/2016 | 10:48:42 AM
ransomware attacks
 

Ransomware attacks are becoming its own industry, it will be harder to declare defense system when you have many people profiting from it. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/27/2016 | 10:45:11 AM
Re: It continues
"... Rather than a second punch, additional botnet infection is more like a bump against the victim after the first good punch. ..."

I was thinking the same thing, after ransomware you would want the victims to focus on recovering from it so you get paid then dealing with DDoS attacks. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/27/2016 | 10:41:45 AM
Re: It continues
"... ever-onward evolution of malware continues  ..."

Good way to put it. They really come up with creative ideas to keep people feel threatened.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/27/2016 | 10:39:40 AM
Ransomware And DDoS
I am not sure why anybody would need to do DDoS at the same time of a Ransomware attack. If intention is not Ransomware that is understandable, but otherwise it does not make sense to me.
AndrewfOP
50%
50%
AndrewfOP,
User Rank: Moderator
5/25/2016 | 8:43:22 AM
Re: It continues
I agree that Ransomware has been the gravest IT security threat.  Though, I am not too sure about, as this aritcle suggests, the DDoS bots.  Rather than a second punch, additional botnet infection is more like a bump against the victim after the first good punch.  Most of the rightful owners of DDoS bots either don't know their computers are infrected, or simply just don't care.  There may be terrible costs for the intended targets of the attacks, but for the actual owners of the bots, not so much.

 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
5/25/2016 | 7:51:46 AM
It continues
And so the ever-onward evolution of malware continues and it's up to the security community to respond. I doubt we'll ever reach a point where these sorts of threats can be heade off at the pass, but here's hoping we nip ransomware in the bud soon. That's about the only malware that truly concerns me at this point.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-6287
PUBLISHED: 2020-07-14
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create a...
CVE-2020-6289
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.
CVE-2020-6290
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
CVE-2020-6291
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
CVE-2020-6292
PUBLISHED: 2020-07-14
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.