Ransomware Attack Involving Scarab Malware Sends Over 12M Emails in 6 Hours

Por Wagas em 28/11/2017 no site HackRead

Security researchers at the Austin based Anti-virus software firm Forcepoint have discovered a massive spam ransomware campaign in which the Scarab malware destroys all your files if you don’t pay the ransom, which is asked in Bitcoin.

The campaign was started on 23rd November while attackers have used the largest email spam botnet on the internet called Necurs for distributing malicious emails. Given the extraordinary scope of Necurs, within 6 hours of its launching, around 12.5 million emails were distributed. This means the botnet is sending out over two million messages per hour and all the 12.5 million emails contained ransomware.

Scarab/Necurs emails intercepted per hour

Various security experts noticed a sudden hike in emailing activity on the web, but Forcepoint was the first to identify the new ransomware campaign. Scarab, however, isn’t a new malware as it has been used in a number of previous campaigns. This campaign primarily targets computers located in the US, UK, Germany, France, and Australia. Researchers observed that the ransomware code included references to popular HBO TV series Game of Thrones.

According to cybersecurity firm AlienVault’s security researcher Chris Doman, the Necurs botnet has remained one of the largest since its creation in 2012 while organized cybercriminals like those behind Locky and Dridex have used it so far, but Scarab comparatively isn’t that sophisticated and can be detected by almost all anti-virus programs.

“Scarab looks less sophisticated than some other ransomware, like Locky, and the usage of an e-mail based ransom payment system is very simple in contrast to its wide distribution,” noted Doman.

Security experts Ben Gibney and Roland Dela Paz from Forcepoint wrote in their blog that the payload Scarab was discovered in June and after installation, just like every other ransomware it also starts encrypting all the files before dropping the ransom note.

‘Once installed it proceeds to encrypt files. A ransom note with the filename “If You Want To Get All Your Files Back, Please Read This.Txt” is dropped within each affected directory,” read the blog post.

The ransom note reads: “Your files are now encrypted! You have to pay for decryption of Bitcoins. The price depends on how fast you write to us. After payment, we will send you the decryption tool.”

According to Forcepoint, fake scanned documents that contain actually infected files are being distributed in emails. It seems that these emails were produced through printers from renowned firms including HP, Lexmark, Epson and Canon to make them look genuine. When the recipient downloads and opens the attached 7zip file the malware takes control of the entire computer and threatens the victim to destroy all the files if the ransom is not paid.

Ransom message displayed by Scarab malware

Although Scarab is distributed at an astoundingly wide scale since it can be detected by a majority of anti-virus software, therefore, users will receive a warning message about the presence of infected files. On the other hand, those users who have become victims of this campaign can run anti-virus software in safe mode to remove the malware; but this isn’t a proven method.

Gibney and Dela Paz opine noted that nowadays even inexperienced hackers can pull off massive global ransomware campaigns only because they have the valuable services of Necurs type botnets at their disposal.

“It remains a question whether this is a temporary campaign, as was the case with Jaff, or if we will see Scarab increase in prominence through Necurs-driven campaigns,” wrote the researchers in their blog. You can read more about this campaign on MyOnlineSecurity, F-Secure, and Forcepoint.

Notice of Ransomware Attack Released by National Capital Poison Center

Por David Bisson em 12/12/2017 no site The State of Security

The National Capital Poison Center (NCPC) in Washington, DC has published notice of a ransomware attack it suffered back in 2017.

According to the news release (PDF), the critical health resource detected a ransomware infection on its systems in October 2017. It then launched an investigation into the matter with the assistance of a third-party forensic expert. Here’s what the NCPC has learned so far:

While this investigation is ongoing, on November 27, 2017, NCPC determined that unauthorized access to a database server occurred on October 21, 2017, and that unauthorized access to the data stored on that server cannot be ruled out. The possibly affected database contains information provided during calls made to or from the center between January 1997 and October 21, 2017.

The NCPC goes on to clarify that the affected database did not contain Social Security Numbers, passport data, or any type of financial information. Instead it consisted of personal information collected during call center calls like a person’s name, date of birth, address, phone number, email address, and medical recommendations discussed over the phone.

At this time, it’s unclear what ransomware struck the NCPC, whether it paid the ransom or restored from backups, and how many people the attack might have affected.

Dr. Toby Litovitz, Executive and Medical Director of NCPC, urges those concerned by the possible exposure of their personal information to reach out to the Center:

NCPC takes the security of information stored on our systems very seriously, and we understand this incident may cause concern or inconvenience. We continue to work with third-party forensic investigators to ensure the security of our systems, and encourage people to contact us at 877-218-3009 (U.S. and Canada callers) or 814-201-3664 (international callers) with any questions or concerns.

The NCPC currently lacks complete contact information for at least some of the records in the affected database. As a result, it’s posting the ransomware notice on its homepage (poison.org) along with the websites of state media outlets and publications. It’s also urging those who might be affected to place a fraud alert or credit freeze on their credit reports with TransUnion, Experian, Equifax, and Innovis.

In the meantime, organizations can protect themselves against ransomware attacks by implementing foundational security measures that, among other things, protect data via encryption, limit what individuals can access sensitive information, and ensure an organization can recover from a data corruption incident using data backups. Learn more about these controls and how they pair with Tripwire’s solutions here.

News of this attack follows less than three months after Arkansas Oral & Facial Surgery Center notified128,000 patients of a ransomware attack that might have exposed their information.

Mais de um quarto dos ataques de ransomware neste ano teve como alvo empresas

Da Redação Computerworld

06 de Dezembro de 2017 

Neste ano, 26,2% dos alvos de ransomware foram usuários corporativos. Em 2016, essa proporção foi de 22,6%. Isso se deve, em parte, a três ataques de ransomware sem precedente que atingiram redes corporativas e mudaram para sempre o cenário dessa ameaça cada vez mais perigosa.

Segunda a Kaspersky Lab, 2017 será lembrado como o momento em que a ameaça do ransomware expandiu-se repentinamente, com agentes de ameaças avançadas atacando empresas no mundo todo em uma série de ataques destrutivos acionados por worms, cujo objetivo final continua sendo um mistério. Esses ataques incluíram o WannaCry em 12 de maio, o ExPetr em 27 de junho e o BadRabbit no final de outubro. Todos usaram exploits criados para comprometer redes corporativas. As empresas também foram alvo de outros ransomwares.

“Os ataques que ocuparam as manchetes em 2017 são um exemplo extremo do crescente interesse dos criminosos nos alvos corporativos. Nós identificamos essa tendência em 2016. Ela se acelerou durante 2017 e não mostra sinais de perder velocidade”, disse Fedor Sinitsyn, analista sênior de malware da Kaspersky Lab. “As vítimas corporativas são incrivelmente vulneráveis; é possível cobrar delas um resgate maior que de indivíduos e, muitas vezes, estão dispostas a pagar para manter a empresa funcionando. Não é surpresa que os vetores de infecção focados em novos negócios, como por meio de sistemas de área de trabalho remota, também estejam em ascensão.”

O relatório revela ainda que, no todo, pouco menos de 950 mil usuários únicos foram atacados neste ano, na comparação com cerca de 1,5 milhão em 2016. Segundo a Kaspersky, essa diferença entre os números é, em grande medida, reflexo da metodologia de detecção — por exemplo, os “baixadores” frequentemente associados ao criptomalware agora são melhor detectados por tecnologias heurísticas e não mais classificados junto com os vereditos referentes a ransomware coletados pela telemetria.

Os três ataques principais, além de outras famílias menos famosas, como AES-NI e Uiwix, usaram exploits sofisticadas espalhadas on-line no segundo trimestre de 2017 por um grupo conhecido como Shadow Brokers. De acordo com o estudo, houve um declínio no número de novas famílias de ransomware (38 em 2017, 62 em 2016), com um aumento correspondente nas modificações de ransomware existentes (mais de 96 mil novas modificações detectadas em 2017, em comparação com 54 mil em 2016). Esse aumento nas modificações pode ser reflexo de tentativas dos invasores de obscurecer seu ransomware conforme as soluções de segurança aprimoraram sua detecção.

A partir do segundo trimestre deste ano, segundo a Kaspersky, uma série de grupos encerrou suas atividades com ransomware e publicou as chaves necessárias para descriptografar arquivos. Entre eles, AES-NI, xdata, Petya/Mischa/GoldenEye e Crysis. O Crysis reapareceu depois, possivelmente ressuscitado por outro grupo.

A crescente tendência de infectar empresas por meio de sistemas de área de trabalho remota continuou neste ano, quando essa abordagem se tornou um dos principais métodos de propagação de várias famílias difundidas, como Crysis, Purgen/GlobeImposter e Cryakl. Além disso, aproximadamente 65% das empresas atingidas por ransomware disseram ter perdido o acesso a um volume significativo ou até a todos os seus dados. Uma em cada seis das que pagaram o resgate não conseguiu recuperar seus dados. Esses números são muito consistentes com os de 2016.

22 Ransomware Prevention Tips

David Balaban em 24/01/2016 no site The State of Security

Dealing with the aftermath of ransomware attacks is like Russian roulette, where submitting the ransom might be the sole option for recovering locked data. This is precisely why focusing on prevention is a judicious approach to adopt.

The growth of ransomware over the past few years has driven the security industry to create myriads of tools applicable for blocking these types of threats from being executed on computers. Few of them are 100% bulletproof, though.

This article is focused on additional measures that users should employ to ensure a higher level of defense against these plagues.

1. First and foremost, be sure to back up your most important files on a regular basis.

Ideally, backup activity should be diversified, so that the failure of any single point won’t lead to the irreversible loss of data. Store one copy in the cloud, resorting to services like Dropbox, and the other on offline physical media, such as a portable HDD.

An efficient tactic is to toggle data access privileges and set read/write permissions, so that the files cannot be modified or erased. An additional tip is to check the integrity of your backup copies once in a while.

2. Personalize your anti-spam settings the right way.

Most ransomware variants are known to be spreading via eye-catching emails that contain contagious attachments. It’s a great idea to configure your webmail server to block dubious attachments with extensions like .exe, .vbs, or .scr.

3. Refrain from opening attachments that look suspicious.

Not only does this apply to messages sent by unfamiliar people but also to senders who you believe are your acquaintances. Phishing emails may masquerade as notifications from a delivery service, an e-commerce resource, a law enforcement agency, or a banking institution.

4. Think twice before clicking.

Dangerous hyperlinks can be received via social networks or instant messengers, and the senders are likely to be people you trust, including your friends or colleagues. For this attack to be deployed, cybercriminals compromise their accounts and submit bad links to as many people as possible.

5. The Show File Extensions feature can thwart ransomware plagues, as well.

This is a native Windows functionality that allows you to easily tell what types of files are being opened, so that you can keep clear of potentially harmful files. The fraudsters may also utilize a confusing technique where one file can be assigned a couple of extensions.

For instance, an executable may look like an image file and have a .gif extension. Files can also look like they have two extensions – e.g., cute-dog.avi.exe or table.xlsx.scr – so be sure to pay attention to tricks of this sort. A standalone known attack vector is through malicious macros enabled in Microsoft Word documents.

6. Patch and keep your operating system, antivirus, browsers, Adobe Flash Player, Java, and other software up-to-date.

This habit can prevent compromises via exploit kits.

7. In the event a suspicious process is spotted on your computer, instantly turn off the Internet connection.

This is particularly efficient on an early stage of the attack because the ransomware won’t get the chance to establish a connection with its Command and Control server and thus cannot complete the encryption routine.

8. Think of disabling vssaexe.

This functionality built into Windows to administer Volume Shadow Copy Service is normally a handy tool that can be used for restoring previous versions of arbitrary files. In the framework of rapidly evolving file-encrypting malware, though, vssadmin.exe has turned into a problem rather than a favorable service.

If it is disabled on a computer at the time of a compromise, ransomware will fail to use it for obliterating the shadow volume snapshots. This means you can use VSS to restore the blatantly encrypted files afterwards.

9. Keep the Windows Firewall turned on and properly configured at all times.

10. Enhance your protection more by setting up additional Firewall protection.

There are security suites out there that accommodate several Firewalls in their feature set, which can become a great addition to the stock defense against a trespass.

11. Adjust your security software to scan compressed or archived files, if this feature is available.

12. Disabling Windows Script Host could be an efficient preventive measure, as well.

13. Consider disabling Windows PowerShell, which is a task automation framework.

Keep it enabled only if absolutely necessary.

14. Enhance the security of your Microsoft Office components (Word, Excel, PowerPoint, Access, etc.).

In particular, disable macros and ActiveX. Additionally, blocking external content is a dependable technique to keep malicious code from being executed on the PC.

15. Install a browser add-on to block popups as they can also pose an entry point for ransom Trojan attacks.

16. Use strong passwords that cannot be brute-forced by remote criminals.

Set unique passwords for different accounts to reduce the potential risk.

17. Deactivate AutoPlay.

This way, harmful processes won’t be automatically launched from external media, such as USB memory sticks or other drives.

18. Make sure you disable file sharing.

This way, if you happen to get hit, the ransomware infection will stay isolated to your machine only.

19. Think of disabling remote services.

Otherwise, the threat could rapidly propagate across the enterprise network, thus calling forth serious security issues for the business environment if your computer is a part it.

For example, the Remote Desktop Protocol can be leveraged by the black hat hackers to expand the attack surface.

20. Switch off unused wireless connections, such as Bluetooth or infrared ports.

There are cases when Bluetooth get exploited for stealthily compromising the machine.

21. Define Software Restriction Policies that keep executable files from running when they are in specific locations in the system.

The directories most heavily used for hosting malicious processes include ProgramData, AppData, Temp and Windows\SysWow.

22. Block known-malicious Tor IP addresses.

Tor (The Onion Router) gateways are the primary means for ransomware threats to communicate with their C&C servers. Therefore, blocking those may impede the critical malicious processes from getting through.

Since ransomware is definitely today’s number one cyber peril due to the damage it causes and the prevalence factor, the countermeasures above are a must. Otherwise, your most important files could be completely lost.

The key recommendation, though, is the one about backups – offline or in the cloud. In this scenario, the recovery consists of removing the ransom Trojan and transferring data from the backup storage.

Currently, dealing with the consequences of ransomware isn’t very promising from the file decryption perspective. That is why thwarting the virus attack can save you a pretty penny and guarantee peace of mind.

November 2017: The Month in Ransomware

Em 06/12/2017 no site The State of Scurity

November didn’t shape up to be revolutionary in terms of ransomware, but the shenanigans of cyber-extortionists continued to be a major concern. The reputation of the Hidden Tear PoC ransomware project hit another low as it spawned a bunch of new real-life spinoffs. The crooks who created the strain dubbed Ordinypt should be really ashamed of themselves, as their brainchild goes a scorched-earth route and simply destroys victims’ data beyond recovery. Furthermore, quite a few copycats of the infamous WannaCry ransomware popped up only to demonstrate that the original is always better than the sequel.

All in all, here’s a brief statistical breakdown of the month: 37 new ransomware species were discovered, 23 existing samples got a facelift, and three ransomware decryptors were released by the white hats.

NOVEMBER 1, 2017

Hidden Tear offshoot with French origin

Threat actors continue to abuse the proof-of-concept Hidden Tear ransomware. Its newest real-life incarnation targets French users, appends encrypted files with the .hacking extension, and instructs victims to contact the attacker at fbi-cybercrimedivision@hotmail.com.

NOVEMBER 2, 2017

Ostentatious claims regarding Hidden Tear

An umpteenth remake of the above-mentioned academic Hidden Tear goes live. It blemishes encrypted files with the .locked string, drops READ_ME.txt help manual, and displays a questionably truthful warning screen that says it’s “one of the most powerful ransomware’s around”.

Magniber strain updated

Magniber, a ransomware sample that’s most likely a successor to the nasty Cerber culprit, undergoes an update within one of the multiple affiliate campaigns. The infection switches to subjoining the .skvtb extension to ransomed files.

It’s time for Jigsaw to get some fine-tuning

Cybercriminals release a new variant of the Jigsaw ransomware, a true old stager on the extortion arena. The pest now appends the .game suffix to victims’ data entries while still displaying the same movie-themed background.

Hermes ransomware remake

Hermes 2.1 Ransomware is what this perpetrating program’s current edition is called. It stains encrypted files with the .HRM extension and leverages a mix of the RSA cipher and Microsoft’s CryptGenRandom function to lock data.

New hallmarks of the Matrix ransomware

A few tweaks are made to the existing blackmail Trojan called Matrix. Its latest build labels hostage data with the _[RELOCK001@TUTA.IO].[original extension] string and provides recovery steps in a document named !OoopsYourFilesLocked!.rtf.

NOVEMBER 3, 2017

GIBON ransomware released and quickly decrypted

This one appears to be quite professionally tailored, but that’s a delusive impression in a way. It concatenates the .encrypt extension to files, leaves a ransom how-to named READ_ME_NOW.txt, and works just like garden-variety ransomware. However, malware analyst Michael Gillespie finds a way to defeat the crypto and contrives a free decryption tool shortly after GIBON’s discovery.

Sad Ransomware lives up to its name

The specimen in question drops _HELPME_DECRYPT.html rescue note and appends a victim-specific extension to locked files. When it’s done encrypting data, it generates a short beep sound. Files cannot be decrypted without meeting the ransom so far.

Ranion ransomware gets a fresh look and feel

Ranion was originally spotted in early February 2017 as a RaaS (Ransomware-as-a-Service) platform. It took the crooks nine months to come up with a fresh edition that blemishes a plagued user’s files with the .ransom extension and provides recovery tips in README_TO_DECRYPT_FILES.html manual. The ransom note is available in seven different languages.

NOVEMBER 4, 2017

Hidden Tear echoes back, once again

A new blackmail virus based on the educational Hidden Tear code appears. It’s called Curumim and targets Portuguese-speaking audience. The pest concatenates the .curumim extension to encoded files and provides a ransom payment deadline of one day.

XiaoBa ransomware updated

This strain originally surfaced on October 27, so it took the ne’er-do-wells one week to craft and release an updated edition. The infection now locks the screen of an infected PC and demands a Bitcoin equivalent of 250 RMB (Chinese Yuan), which is worth about $37.

Zika ransomware continues the HT saga

The scandalous Hidden Tear project gives rise to Zika, a ransom Trojan targeting Spanish-speaking users. It concatenates the .teamo string to locked data items.

Waffle ransomware isn’t too delicious

The new Waffle ransomware is exactly what it sounds like. Its ransom notification is named ‘Waffle’ and includes a picture of a bunch of waffles in the background. Furthermore, it appends the .waffle extension to a victim’s files. The ransom amounts to $50 worth of Bitcoin.

NOVEMBER 6, 2017

Unexpected details of the GIBON ransomware unearthed

In-depth analysis of the GIBON ransomware campaign has revealed that it’s much older than previously thought. Specifically, this turnkey ransomware kit has been marketed on Russian dark web forums since May 2017.

NOVEMBER 7, 2017

Sigma ransomware spotted

The payload of this sample is disguised as GUID Helper tool (GUID.exe.bin). Having encrypted a victim’s valuable files, Sigma stains them with a random extension and drops a ransom how-to document named ReadMe.txt. The attackers demand $1,000 worth of Bitcoin for the private key and decryptor software.

NOVEMBER 8, 2017

The premature Christmas Ransomware

Extortionists are, obviously, prepping for the holiday season with the new Christmas Ransomware. It displays a picture of a leafless forest with Christmas toys hanging on the trees. The ransom amounts to 0.03 Bitcoin (about $230). It is currently in development and does not encrypt data yet.

Another city hit by blackmail virus

The computer servers of the city of Spring Hill, TN get hijacked by an unknown strain of ransomware. The infection reportedly took root as an employee clicked on a booby-trapped email attachment. As a result, city workers are unable to use email and accept online payments. The criminals ask for $250,000 to restore the affected services.

Jhash ransomware uses a file extension familiar to many

The fresh sample called Jhash is a Hidden Tear spinoff zeroing in on Spanish-speaking computer users. It subjoins the .locky extension to encoded files and instructs victims to submit ransoms via the Payza online payment platform.

NOVEMBER 9, 2017

Ordinypt – classic ransomware or wiper?

The specimen in question is propagating in Germany. Ordinypt drops rescue notes named Wo_sind_meine_Dateien.html (“Where_are_my_files.html” in English). As opposed to commonplace crypto parasites, this one overwrites files with random values instead of encrypting them. Consequently, there is no way to restore the data.

NOVEMBER 10, 2017

LockCrypt has got a RaaS-related background

The sample called LockCrypt was originally distributed via a Ransomware-as-a-Service platform called Satan. Later on, the threat actors must have invested some money and effort to code their own ransomware operating independently from the RaaS. LockCrypt is deposited on computers and servers by brute-forcing RDP credentials.

CrySiS ransomware fine-tuned

The most recent edition of the CrySiS, or Dharma, ransomware switches to adding the .cobra extension to locked files. It also drops ‘Files encrypted!!.txt’ ransom note and instructs victims to contact the attackers at cranbery@colorendgrace.com for recovery steps.

LOL ransomware passes itself off as a keygen

The malicious binary of the C# based LOL ransomware strain is masqueraded as a keygen application for VMware products. It concatenates the .lol string to encrypted files.

NOVEMBER 11, 2017

Jigsaw strain gets slightly modified

A brand-new variant of the Jigsaw ransomware is detected in the wild. It stains hostage data with the .##encrypted_by_pabluklocker## extension token and displays an updated set of messages.

Blackmail virus pretending to come from Cyber Police

Threat actors take advantage of the Hidden Tear project to coin another real-world crypto infection. The latest incarnation sports a warning message saying, “Your computer is blocked by Cyber Police for unlicensed software’s usage.” The pest subjoins the .locked suffix to ransomed files.

GlobeImposter changes its behavior

Some of the recent editions of the fertile GlobeImposter strain feature an externally inconspicuous yet significant modification in their modus operandi. The developers have changed the culprits’ config extraction script and the technique used to encrypt configuration data.

NOVEMBER 12, 2017

Stroman ransomware resurfaces

Although the perpetrating program in question hasn’t ever been in wide distribution and pretty much vanished from the extortion arena lately, it spawned a new version out of the blue. The baddie now concatenates the .fat32 extension to files and provides recovery tips in the info.txt manual.

NOVEMBER 13, 2017

CryptoMix reaches the end of alphabet

The latest mod of the fairly professionally made CryptoMix ransomware switches to using the .XZZX extension string for scrambled files. As before, the rescue note is named _HELP_INSTRUCTION.txt.

jCandy isn’t sweet at all

Malware analysts stumble upon a fresh specimen called jCandy. It affixes the .locked-jCandy string to no-longer-accessible data. Interestingly, this one drops two different editions of the ransom how-to at the same time named READ_ME.txt and JCANDY_INSTRUCTIONS.txt.

In-dev French ransomware discovered

Once again, security experts were able to spot a blackmail infection before it went real-world. This one displays all of its warnings in French and is configured to stain files with the .lockon suffix. This would-be baddie currently doesn’t encrypt data anywhere except a directory named ‘testrw’.

Dr.Web cracks a relatively new ransom Trojan

A ransomware lineage blemishing encrypted data with the .[attacker’s email].blind or .[attacker’s email].kill extensions is now potentially decryptable courtesy of Dr.Web antivirus vendor. Those infected may be able to restore their files using the company’s Rescue Pack tool. Be advised: this service isn’t free.

Unsurprisingly, GlobeImposter gets another update

The most recent iteration of GlobeImposter brings about the following new attributes: the .kimchenyn file extension, plus a ransom notification named how_to_back_files.html.

Fresh Amnesia2 ransomware version turns out somewhat crude

The edition in question scrambles filenames beyond identification and concatenates the .am extension to each one. Its ransom how-to document, ENCRYPTED FILES.txt, contains nothing but a bunch of digits that don’t make sense. So victims have no idea how to pay the ransom even if they are up to it. This, by the way, isn’t a good idea because a free tool called Emsisoft Decrypter for Amnesia2 supports this pest.

Goofed ransomware surfaces

The silly name doesn’t make this Hidden Tear offspring any less harmful than the rest. It speckles encrypted files with the .goofed extension and provides recovery steps in YOU_DONE_GOOFED.txt document. Goofed ransomware demands $100 worth of Bitcoin for decryption.

NOVEMBER 14, 2017

GlobeImposter authors get naughty

The GlobeImposter family expands with yet another sample. This time, the culprit concatenates the .SEXY extension to ransomed data entries and instructs users to send a message to sexy_chief@aol.com for recovery steps.

NOVEMBER 15, 2017

J. Sterling Student Survey ransomware

This one zeroes in specifically on students of J. Sterling Morton school district, Illinois. Its propagation relies on a bogus student survey that looks trustworthy enough for would-be victims to go ahead and click through. The ransomware does not do any real damage in its current state.

NOVEMBER 16, 2017

RASTAKHIZ ransomware campaign underway

Cybercriminals strike again using the Hidden Tear PoC. One more spinoff labels encrypted data with the .RASTAKHIZ extension. The infection goes with a well-designed GUI.

NOVEMBER 17, 2017

CryptoMix switches to a numeric extension

One more version of the CryptoMix ransomware pops up that concatenates the .0000 string to one’s skewed files and uses an updated set of four contact email addresses. The name of the ransom note is the same (_HELP_INSTRUCTION.txt).

WannaSmile ransomware

This one sure sounds better than the ill-famed WannaCry threat but isn’t much more promising for victims. Its ransom note ‘How to decrypt files.html’ is in Persian. The extension added to filenames is .WSmile.

CorruptCrypt is good at evading AVs

The sample called CorruptCrypt boasts a zero detection rate two days after discovery, which is a disconcerting hallmark. It uses two extensions concurrently to stain locked files, namely .corrupt and .acryhjccbb@protonmail.com.

Hand of God screen locker isn’t celestial at all

The ransom Trojan in question displays an “FBI anti-piracy warning” screen and instructions in French. It coerces victims to pay 0.06 Bitcoin (about $580) for unlocking their computers.

BASS-FES proves the Hidden Tear abuse story is ongoing

Yet another derivative of the academic Hidden Tear starts making the rounds. It’s called BASS-FES, which is an acronym for BitchASS File Encryption System. This pest subjoins the .basslock suffix to encrypted items.

NOVEMBER 18, 2017

Russian imitation of WannaCry appears

The warning screen displayed by this ransomware is a close resemblance to WannaCry’s, but it is titled “Wanna die decrypt0r” and contains Russian text. While still in development, it does not encrypt files at this point.

NOVEMBER 20, 2017

CrySiS ransomware update

The latest mod of the CrySiS/Dharma ransomware strain switches to concatenating the .java extension to encrypted data entries.

NOVEMBER 21, 2017

Cryakl ransomware devs feel fairytale-ish

Cryakl is a lineage that was one of the pioneers on the extortion arena and pretty much vanished from this threat landscape. As part of the first update in many months, though, the pest starts adding the .fairytale string to encoded files.

CryptoLocker lookalike called Locket ransomware

The Locket sample goes with a GUI imitating that of the infamous CryptoLocker. Although it fails to perform encryption, it demands a ransom of 0.1424 BTC (about $1,500).

GlobeImposter fine-tuned

A fresh variant of the GlobeImposter crypto baddie subjoins the .Ipcrestore extension to enciphered files and continues to drop a rescue note named how_to_back_files.html.

NOVEMBER 22, 2017

The unusual qkG ransomware

As opposed to other ransomware strains, the qkG sample only targets Microsoft Office documents spotted on a contaminated computer. To add insult to injury, it also affects all new Word files that the victim opens.

Test version of IGotYou ransomware

The culprit in question appends the .iGotYou extension to encoded files. Luckily, it isn’t fully functional at this point, and it only encrypts data in a Test folder on drive C of the author’s computer. The infection demands 10,000 Indian rupees for decryption, which provides a clue about the developer’s country of residence.

Another day, another WannaCry copycat

Security analysts spot a WannaCry ransomware imitator displaying its warning messages in Portuguese. It coerces victims to submit the ransom of 0.006 BTC within seven days.

NOVEMBER 23, 2017

A similarity between the new Scarab ransomware and Locky

Just like Locky, the old stager in the extortion landscape, the Scarab ransomware is making the rounds via malicious spam generated by the Necurs botnet. It blemishes encrypted files with the .[suupport@protonmail.com].scarab extension and leaves a ransom how-to file named “If you want to get all your files back, please read this.txt”.

Researchers unearth ransomware statistics for Africa

According to Sophos, the top ransomware lineages in Africa as of 2017 are Cerber (80% prevalence), WannaCry (17%), Locky and Jaff (1% each), and the destructive Petya (0.5%).

Cryp70n1c Army blackmail virus

This one is a Hidden Tear offshoot that stains locked data with the .cryp70n1c suffix. It threatens to delete all hostage files unless the victim coughs up the ransom in a three-day timeframe.

NOVEMBER 24, 2017

Girlsomeware appears to be a prank

The new ransom Trojan called Girlsomeware instructs those infected to click on several dozen checkboxes in order to restore allegedly encoded files. However, it doesn’t actually encrypt anything, so the trivial assignment isn’t compulsory at all.

NOVEMBER 25, 2017

ExoBuilder fails to impress

The ExoBuilder tool is being advertised on black hat hacking forums as a means to create new ransomware. It is supposed to subjoin the .exo extension to files and drop a rescue note named UnlockYourFiles.txt. However, all it does is sprinkle a slew of new files all over the computer and displays a full-screen warning to instill fear. An infected user should simply restart their machine to get rid of it.

NOVEMBER 27, 2017

StorageCrypter stands out from the crowd

The specimen codenamed StorageCrypter zeroes in on NAS (network-attached storage) devices. Having skewed one’s valuable files, it concatenates the .locked string to each one and provides recovery steps in the _READ_ME_FOR_DECRYPT.txt how-to document.

Samas ransomware refreshed

A brand-new version of the Samas/SamSam blackmail virus is different than its forerunner in that it uses the .areyoulovemyrans extension to label hostage data.

Magniber starts using a gibberish extension

Magniber, the crypto infection believed to be a successor of Cerber, undergoes fine-tuning in a way. It switches to using the .vpgvlkb extension for ransomed files, which doesn’t appear to make any sense. Another tweak is that it drops a recovery avenue named ‘read me for decrypt.txt’.

Researchers trying to hunt down a new cyber culprit

MalwareHunterTeam’s Michael Gillespie tweets with another ransomware hunt suggestion to fellow-analysts. The baddie being sought is a new French ransom Trojan someone uploaded to the ID Ransomware portal. It stains data with the .locked suffix and uses a rescue note named READ_ME_FOR_ALL_YOUR_FILES.txt. The initiative is to no avail at the time of this writing.

NOVEMBER 28, 2017

HC6 ransomware decrypted

Security experts contrive a free decryption tool supporting the HC6 ransomware. This perpetrating program appends the .fucku extension to encoded files and leaves a ransom note named recover_your_files.txt.

Known ransomware passing itself off as a keygen program

For the record, the CryptON ransomware is a .NET based sample discovered a year ago. Its latest update has introduced a fairly unusual alteration. The infection’s payload now goes camouflaged as a keygen utility for EaseUS Data Recovery, a popular file restoration suite.

Crypt12 strain updated

Security analysts were able to fine-tune the existing free decryptor for Crypt12 ransomware shortly after its new edition has been spotted in the wild. The tool now supports the variant that blemishes encrypted files with the ‘=[victim ID]=hello@boomfile.ru.crypt12’ extension.

MaxiCrypt ransomware discovered

This one scrambles filenames and appends them with the .[maxicrypt@cock.li].maxicrypt extension. The ransom how-to file is named ‘How to restore your data.txt’.

NOVEMBER 29, 2017

Brazilian WannaPeace ransomware spotted

Cybercrooks from Brazil calling themselves AnonymousBr must have decided to pay homage to the mega-successful WannaCry ransomware that broke out in May 2017. The copycat is called WannaPeace. It prepends the ‘_enc’ string to an original file extension. The ransom amounts to 0.08 BTC (about $900).

Crypt888 ransomware reemerges

The proprietors of the extortion campaign through Crypt888 ransomware haven’t released any fresh variants for months. This has changed with a recent update no one in the security circles really expected. The pest now instructs victims to contact the attackers via maya_157_ransom@hotmail.com email address.

NOVEMBER 30, 2017

HC6 strain upgraded to HC7? How prosaic

The brand new HC7 variant from the existing lineage uses the .GOTYA string to stain encrypted files. According to preliminary analysis, it infects computers via hacked RDP services.

ACCDFISA ransomware gaining momentum in Brazil

This sample is one of the oldest known ransom Trojans that has literally risen from the ashes. The name stands for ‘Anti Cyber Crime Department of Federal Internet Security Agency’, a purported organization that doesn’t even exist. According to statistics obtained via ID Ransomware service, this infection has been increasingly targeting Brazilian users during November.

New lousy specimen out there

Analysts stumble upon a sample using a binary named REAL DANGEROUS RANSOMWARE.exe. Despite the scary executable, it turns out to be all bark but no bite. It’s nothing but a screen locker that a victim can get around by simply pressing Alt+F4.

GlobeImposter and Necurs are now in cahoots

The architects of the GlobeImposter ransomware campaign change their tactics in terms of distribution. The crypto culprit has begun making the rounds via spam generated by Necurs, one of the world’s largest botnets.

SUMMARY

Only three new decryption tools crafted in November versus a slew of fresh ransomware strains still make an unsettling ratio. Under the circumstances, users should rely on their personal online hygiene rather than researchers’ success. Simply exercising caution with spam email attachments significantly reduces the risk of being infected. Keep that in mind, and don’t forget to back up your important files on a regular basis.

About the Author: David Balaban is a computer security researcher with over 10 years of experience in malware analysis and antivirus software evaluation. David runs the www.Privacy-PC.com project which presents expert opinions on the contemporary information security matters, including social engineering, penetration testing, threat intelligence, online privacy and white hat hacking. As part of his work at Privacy-PC, Mr. Balaban has interviewed such security celebrities as Dave Kennedy, Jay Jacobs and Robert David Steele to get firsthand perspectives on hot InfoSec issues. David has a strong malware troubleshooting background, with the recent focus on ransomware countermeasures.

Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.