New ‘Ranscam’ Ransomware Lowers The Bar But Raises The Stakes

Ransomware variants are multiplying like rabbits: while some are more sophisticated and tougher to combat, others are more about scamming than kidnapping. Take the new Ranscam malware discovered by Cisco’s Talos team, a low-tech but highly destructive attack that demands ransom from its victims but never returns them their files because it actually deleted them.

Ranscam isn’t the first ransomware variant to destroy files rather than return them after victims pay up—there’s AnonPop and JIGSAW, for example—but it’s a glaring example of how the ransomware scam itself is so lucrative and easy to pull off that less sophisticated attackers are jumping in the game. It’s also a cautionary tale for victims counting on getting their files back when they hand over those Bitcoins.

The lack of crypto in the attack, despite promises of decryption if the victim pays up, also demonstrates that Ranscam is nowhere near as complex or advanced as Cryptowall and other ransomware attacks, the researchers say. It’s more like its name suggests: it’s a ransomware scam to make money quickly.

"Compared to other true ransomware variants such as Cryptowall which spend a significant amount of time and effort developing new functionality and features, Ranscam appears to indicate that smaller, less-funded threat actors are joining the game, attempting to quickly get a piece of the pie," says Earl Carter, security research engineer at Cisco Talos.

It's also yet another example of why solid backups can save the day in a ransomware attack. "Ranscam further justifies the importance of ensuring that you have a sound, offline backup strategy in place rather than a sound ransom payout strategy,” the Talos team wrote in a blog post today. “Not only does having a good backup strategy in place help ensure that systems can be restored, it also ensures that attackers are no longer able to collect revenue that they can then reinvest into the future development of their criminal enterprise.”

Ranscam pushes the victim the usual ransom note upon infection, claiming to have moved the files to a “hidden, encrypted partition.” The Talos team says it dug around and found that some $278 had been paid to a wallet address provided by the attackers, but no additional transactions had occurred with it since late last month.

The attack appears to be limited, and relies mainly on using fear to solicit victims to pay the ransom. The attackers even had a few mishaps in their payment screen process, Talos found.

And the good news with Ranscam is that it isn't likely to have a long lifespan as a threat. "The payout is likely to die away quickly because of [its] bad reputation" in deleting files, notes Talos' Carter.

Cisco Talos recommends a backup solution that lets you restore an infected system to “a known-good configuration as quickly as possible.” That way, ransomware won’t be so popular and useful to attackers.

Related Content: