Mobile

5/12/2017
01:09 PM
100%
0%

Jaff Ransomware Family Emerges In Force

A new ransomware family is making the rounds in multiple high-volume spam campaigns over the past day, according to Cisco Talos.

A new high-volume ransomware family called Jaff is making the rounds, which carries a smattering of characteristics similar to both the Dridex and Locky campaigns, according to Cisco Talos.

Although Jaff has several characteristics in its distribution and C2 traffic patterns similar to the other two ransomware campaigns, it carries little similarity in its codebase.

In the past 24 hours, Cisco Talos has noticed more than 100,000 emails under the Jaff high-volume spam campaign, which uses a PDF attachment with an embedded Microsoft Word document to act as the initial downloader for the ransomware.  

The attackers are using Necurs to distribute Jaff as multiple, high-volume spam campaigns, which leads Cisco Talos to speculate they may be the same cybercriminals who used Necurs to blast out Locky. But because Jaff's malware is distinct enough from Locky and Dridex, Cisco Talos notes it should be treated as a new ransomware variant.

Read more about Jaff here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20168
PUBLISHED: 2018-12-17
Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.
CVE-2018-20167
PUBLISHED: 2018-12-17
Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME typ...
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.