Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

7/11/2016
05:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

New ‘Ranscam’ Ransomware Lowers The Bar But Raises The Stakes

Cisco Talos researchers discover new variant that doesn't decrypt your files after you pay up--it has already deleted them.

Ransomware variants are multiplying like rabbits: while some are more sophisticated and tougher to combat, others are more about scamming than kidnapping. Take the new Ranscam malware discovered by Cisco’s Talos team, a low-tech but highly destructive attack that demands ransom from its victims but never returns them their files because it actually deleted them.

Ranscam isn’t the first ransomware variant to destroy files rather than return them after victims pay up—there’s AnonPop and JIGSAW, for example—but it’s a glaring example of how the ransomware scam itself is so lucrative and easy to pull off that less sophisticated attackers are jumping in the game. It’s also a cautionary tale for victims counting on getting their files back when they hand over those Bitcoins.

The lack of crypto in the attack, despite promises of decryption if the victim pays up, also demonstrates that Ranscam is nowhere near as complex or advanced as Cryptowall and other ransomware attacks, the researchers say. It’s more like its name suggests: it’s a ransomware scam to make money quickly.

"Compared to other true ransomware variants such as Cryptowall which spend a significant amount of time and effort developing new functionality and features, Ranscam appears to indicate that smaller, less-funded threat actors are joining the game, attempting to quickly get a piece of the pie," says Earl Carter, security research engineer at Cisco Talos.

It's also yet another example of why solid backups can save the day in a ransomware attack. "Ranscam further justifies the importance of ensuring that you have a sound, offline backup strategy in place rather than a sound ransom payout strategy,” the Talos team wrote in a blog post today. “Not only does having a good backup strategy in place help ensure that systems can be restored, it also ensures that attackers are no longer able to collect revenue that they can then reinvest into the future development of their criminal enterprise.”

Ranscam pushes the victim the usual ransom note upon infection, claiming to have moved the files to a “hidden, encrypted partition.” The Talos team says it dug around and found that some $278 had been paid to a wallet address provided by the attackers, but no additional transactions had occurred with it since late last month.

The attack appears to be limited, and relies mainly on using fear to solicit victims to pay the ransom. The attackers even had a few mishaps in their payment screen process, Talos found.

And the good news with Ranscam is that it isn't likely to have a long lifespan as a threat. "The payout is likely to die away quickly because of [its] bad reputation" in deleting files, notes Talos' Carter.

Cisco Talos recommends a backup solution that lets you restore an infected system to “a known-good configuration as quickly as possible.” That way, ransomware won’t be so popular and useful to attackers.

Related Content:

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Faye___Kane
100%
0%
Faye___Kane,
User Rank: Strategist
7/30/2016 | 6:39:16 PM
Re: Ranscams and Ransomware can go down together
 

You'd think that every business would already back up it's stuff, but nooo.

One summer, I babysat the 12 users at a small company when I discovered, to my horror, that the server had never been backed up in seven years(!)

I repeatedly begged the owner, who wore a gold slab around his neck, to buy a $100 tape drive, but he wouldn't spend the money. I finally shut up about it when he got mad at my asking.

When the sys crashed the next month, I drove home depressed. "What would an IT manager at a real company have done to prevent this?  Asked again? Paid for it himself?

The next day, I was fired because I predicted it, and everyone assumed I sabotaged the server to prove my point.

Worse, I'm sure I could have recovered the data if he had let me get near it.

THESE are the people we try so hard to protect.

 
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
7/12/2016 | 11:29:16 AM
Re: Ranscams and Ransomware can go down together
That would be nice, wouldn't it? But the seasoned ransomware attackers aren't going anywhere until orgs of all sizes do a better job at backups so they don't have to pay, and do a better job of user awareness training.
AndrewfOP
100%
0%
AndrewfOP,
User Rank: Strategist
7/12/2016 | 11:21:18 AM
Ranscams and Ransomware can go down together
"..the good news with Ranscam is that it isn't likely to have a long lifespan as a threat..."

 Quite frankly, I would prefer Ransams can stick around long enough to drag Ransomwares down with it.  If Ransams, purported to be 'reputed' Ransomware, receive the ransoms, but fail to deliver the goods anyway, 'customers' would be wised to the idea that paying ransoms are no guarantees of getting the files back.  Only good backups and no ransoms are the best strategy against Ranscams and Ransomwares.  We can then be rid of the Ransomware pandemics.

 
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18217
PUBLISHED: 2019-10-21
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
CVE-2019-16862
PUBLISHED: 2019-10-21
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
CVE-2019-17409
PUBLISHED: 2019-10-21
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
CVE-2019-10715
PUBLISHED: 2019-10-21
There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.
CVE-2019-10716
PUBLISHED: 2019-10-21
An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.