Ransomware Spikes, Tries New Tricks

The quick money to be made in ransomware scams appears to be driving furious innovation in the cybercrime world.

Over the last several months, security researchers have reported seeing malware authors constantly employing new tricks, tools, and techniques to snag victims and stay ahead of security researchers.

A flurry of reports this week shows there’s no sign of the trend slowing down any time soon.

Locky Locks Down

The authors of Locky, one of the most prolific ransomware samples currently in circulation, have gone into full defensive mode. In a report released this week, German security firm Avira Operations said that the group behind Locky had begun using public key encryption to protect communication between victims and the command and control servers that are being used to manage the malware.

In addition to a specific public key for encrypting data on a victim’s computer, Locky now includes an RSA public key to encrypt C&C communications, Avira said in a blog post today. The change makes it much harder for security researchers to eavesdrop on the malware’s activities.

“Previously researchers have been able to sinkhole the domains of Locky’s DGA (domain-name generation algorithm) and provide statistics on infections and activities,” the Avira alert noted.

Researchers will still be able to get IP addresses of victims and know where they are located geographically using a sinkhole. But the change makes it impossible for researchers to collect information, like size of the victim, the ransom amounts demands, the type of infected operation system, and other details, Avira said.

It is likely that the encryption is a pre-emptive move by Locky’s authors to prevent other cybercriminals from making knock-offs of the malware, Avira security researcher Moritz Kroll said in the blog post.

In separate but related news, a new report from Proofpoint summarizing the threat landscape in the first quarter of 2016 showed that 24% of all email attacks involving malicious attachments featured Locky. The only other e-mailed based malware sample that was more prevalent in the first quarter was Dridex, a banking Trojan that is beginning to be used increasingly in ransomware attacks as well.

Brute Force Remote Desktop Protocol Attacks

Netherlands-based security consultancy Fox-IT Monday said its researchers had observed an uptick in the use of compromised remote desktop servers to activate ransomware on victim computers.

Unlike typical ransomware infections, which involve the use of malicious email attachments in spam and phishing emails, some threat actors have begun going after Internet-connected remote desktop servers belonging to enterprises.

In an alert, Fox-IT senior forensic IT expert Wouter Jansen said the company had investigated several recent incidents where threat actors had used brute-force attacks on enterprise remote desktop servers in a bid to break into them. Such access typically gives attackers the ability to search for and find a lot more servers and data to encrypt than other methods, Jansen warned.

“As the attackers have a lot of knowledge of the compromised network and company, their position in the negotiation is stronger than when infection took place through a drive-by download or infected e-mail attachment,” Jansen said. “The demanded ransom reflects this and could be significantly higher,” the security researcher warned.

More Personalized and Professional

Ransomware authors are getting more creative about how they target victims, Trend Micro said in a report released Monday. Some have begun using macros and scripts, displaying professional-looking phishing pages, adding new functions, and modifying a computer’s master boot record to get victims to activate the malware on their systems, the security vendor said.

As examples, Trend Micro pointed to Maktublocker, a ransomware sample that targets victims with emails containing their full and correct names and mailing addresses and Cerber, a ransomware tool that features a voice capability to try and convince users to activate it. Some tools appear to be getting user-friendly as well. One example is TrueCrypter that demands its ransom in the form of an Amazon gift card, Trend Micro said.

Meanwhile, ransomware infections continue to go through the roof. Anti-spyware vendor Enigma Software on Monday released a report showing that April was the worst month on record for ransomware in the US. According to the company, the number of ransomware samples detected by its product jumped over 158% between February and March of this year alone.

Related stories: