Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/2/2016
06:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Ransomware Spikes, Tries New Tricks

Ransomware authors constantly upping their game, techniques, to stay ahead of security researchers.

The quick money to be made in ransomware scams appears to be driving furious innovation in the cybercrime world.

Over the last several months, security researchers have reported seeing malware authors constantly employing new tricks, tools, and techniques to snag victims and stay ahead of security researchers.

A flurry of reports this week shows there’s no sign of the trend slowing down any time soon.

Locky Locks Down

The authors of Locky, one of the most prolific ransomware samples currently in circulation, have gone into full defensive mode. In a report released this week, German security firm Avira Operations said that the group behind Locky had begun using public key encryption to protect communication between victims and the command and control servers that are being used to manage the malware.

In addition to a specific public key for encrypting data on a victim’s computer, Locky now includes an RSA public key to encrypt C&C communications, Avira said in a blog post today. The change makes it much harder for security researchers to eavesdrop on the malware’s activities.

“Previously researchers have been able to sinkhole the domains of Locky’s DGA (domain-name generation algorithm) and provide statistics on infections and activities,” the Avira alert noted.

Researchers will still be able to get IP addresses of victims and know where they are located geographically using a sinkhole. But the change makes it impossible for researchers to collect information, like size of the victim, the ransom amounts demands, the type of infected operation system, and other details, Avira said.

It is likely that the encryption is a pre-emptive move by Locky’s authors to prevent other cybercriminals from making knock-offs of the malware, Avira security researcher Moritz Kroll said in the blog post.

In separate but related news, a new report from Proofpoint summarizing the threat landscape in the first quarter of 2016 showed that 24% of all email attacks involving malicious attachments featured Locky. The only other e-mailed based malware sample that was more prevalent in the first quarter was Dridex, a banking Trojan that is beginning to be used increasingly in ransomware attacks as well.

Brute Force Remote Desktop Protocol Attacks

Netherlands-based security consultancy Fox-IT Monday said its researchers had observed an uptick in the use of compromised remote desktop servers to activate ransomware on victim computers.

Unlike typical ransomware infections, which involve the use of malicious email attachments in spam and phishing emails, some threat actors have begun going after Internet-connected remote desktop servers belonging to enterprises.

In an alert, Fox-IT senior forensic IT expert Wouter Jansen said the company had investigated several recent incidents where threat actors had used brute-force attacks on enterprise remote desktop servers in a bid to break into them. Such access typically gives attackers the ability to search for and find a lot more servers and data to encrypt than other methods, Jansen warned.

“As the attackers have a lot of knowledge of the compromised network and company, their position in the negotiation is stronger than when infection took place through a drive-by download or infected e-mail attachment,” Jansen said. “The demanded ransom reflects this and could be significantly higher,” the security researcher warned.

More Personalized and Professional

Ransomware authors are getting more creative about how they target victims, Trend Micro said in a report released Monday. Some have begun using macros and scripts, displaying professional-looking phishing pages, adding new functions, and modifying a computer’s master boot record to get victims to activate the malware on their systems, the security vendor said.

As examples, Trend Micro pointed to Maktublocker, a ransomware sample that targets victims with emails containing their full and correct names and mailing addresses and Cerber, a ransomware tool that features a voice capability to try and convince users to activate it. Some tools appear to be getting user-friendly as well. One example is TrueCrypter that demands its ransom in the form of an Amazon gift card, Trend Micro said.

Meanwhile, ransomware infections continue to go through the roof. Anti-spyware vendor Enigma Software on Monday released a report showing that April was the worst month on record for ransomware in the US. According to the company, the number of ransomware samples detected by its product jumped over 158% between February and March of this year alone.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
5/3/2016 | 7:33:46 AM
Business focus
As much as it might seem like an unfair stance to take, I hope ransomeware continues to target enterprises more. Not only are they less likely to be personally - although financially - affected, but they are more likely to have insurance in place to cover potential losses. 

It could also encourage better security of data at these companies.

When consumers are targeted though, it's emotional damage that's mostly done through a loss of images and personal files. That's far more nefarious.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .