Home » Ransomware

A Look at Locky Ransomware’s Recent Spam Activities

Posted on:October 19, 2017 at 5:01 am
Posted in:Ransomware, Spam
Author:
Rubio Wu (Threats Analyst)

Ransomware has been one of the most prevalent, prolific, and pervasive threats in the 2017 threat landscape, with financial losses among enterprises and end users now likely to have reached billions of dollars. Locky ransomware, in particular, has come a long way since first emerging in early 2016. Despite the number of times it apparently spent in hiatus, Locky remains a relevant and credible threat given its impact on end users and especially businesses. Our detections show that it’s making another comeback with new campaigns.

A closer look at the file-encrypting malware’s activities reveals a constant: the use of spam. While they remain a major entry point for ransomware, Locky appears to be concentrating its distribution through large-scale spam campaigns of late, regardless of the variants released by its operators/developers.

Posted on:October 18, 2017 at 7:00 am
Posted in:Bad Sites, Exploits, Ransomware
Author:
Joseph C Chen (Fraud Researcher)

A new ransomware is being distributed by the Magnitude exploit kit: Magniber (detected by Trend Micro as RANSOM_MAGNIBER.A), which we found targeting South Korea via malvertisements on attacker-owned domains/sites. The development in Magnitude’s activity is notable not only because it eschewed Cerber—its usual ransomware payload—in favor of Magniber. Magnitude now also appears to have become an exploit kit expressly targeting South Korean end users.

The Magnitude exploit kit, which previously had a global reach, was offered as a service in the cybercriminal underground as early as 2013. It then left the market and became a private exploit kit that mainly distributed ransomware such as CryptoWall. At the start of the second half of 2016, Magnitude shifted focus to Asian countries, delivering various ransomware such as Locky and Cerber. More recently though, we noticed that Magnitude underwent a hiatus that began on September 23, 2017, and it then returned on October 15. With help from Kafeine and malc0de, we were able to uncover Magnitude’s new payload, Magniber.

Posted on:October 10, 2017 at 5:01 am
Posted in:Deep Web, Malware, Ransomware
Author:
Mayra Rosario Fuentes (Senior Threat Researcher)

For $50, one could purportedly get a lifetime license to upgradeable variants of WannaCry. We saw this advertisement in an Arabic-speaking underground forum on May 14, two days after WannaCry’s outbreak. Indeed, a threat that left a trail of significant damage in its wake was objectified into a commodity, and even a starting point for others to launch their own cybercriminal businesses.

WannaCry’s relatively low price also reflects another unique aspect of the Middle Eastern and North African underground: a sense of brotherhood. Unlike marketplaces in Russia and North America, for instance, where its players aim to make a profit, the Middle East and North Africa’s underground scene is an ironic juncture where culture, ideology, and cybercrime meet.

Posted on:September 18, 2017 at 9:00 am
Posted in:Ransomware, Spam
Author:
Trend Micro

In the beginning of September, a sizeable spam campaign was detected distributing a new Locky variant. Locky is a notorious ransomware that was first detected in the early months of 2016 and has continued to evolve and spread through different methods, particularly spam mail. A thorough look at samples from recent campaigns shows that cybercriminals are using sophisticated distribution methods, affecting users in more than 70 countries.

In the specific campaigns discussed below, both Locky and the ransomware FakeGlobe were being distributed—but the two were rotated. The cybercriminals behind the campaign designed it so that clicking on a link from the spam email might deliver Locky one hour, and then FakeGlobe the next. This makes re-infection a distinct possibility, as victims infected with one ransomware are still vulnerable to the next one in the rotation.

Posted on:August 28, 2017 at 5:30 am
Posted in:Mobile, Ransomware
Author:
Mobile Threat Response Team

The mobile threat landscape isn’t just rife with information stealers and rooting malware. There’s also mobile ransomware. While it seems they’re not as mature as their desktop counterparts, what with the likes of WannaCry and Petya, the increasing usage of mobile devices, particularly by businesses, will naturally draw more cybercriminal attention to this type of threat.

Take for instance mobile ransomware on the Android platform. The variants we detected and analyzed during the fourth quarter of last year were thrice as many compared to the same period in 2015. And indeed, the surge is staggering. We already had over 235,000 detections for Android mobile ransomware in the first half of 2017 alone—that’s 181% of detections for all of 2016.

Page 1 of 2312 › »

A Look at Locky Ransomware’s Recent Spam Activities

Magnitude Exploit Kit Now Targeting South Korea With Magniber Ransomware

WannaCry Ransomware Sold in the Middle Eastern and North African Underground

Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns

Android Mobile Ransomware: Bigger, Badder, Better?

Business Process Compromise

Business Email Compromise

Latest Ransomware Posts

Ransomware 101

Stay Updated

A Look at Locky Ransomware’s Recent Spam Activities

Magnitude Exploit Kit Now Targeting South Korea With Magniber Ransomware

WannaCry Ransomware Sold in the Middle Eastern and North African Underground

Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns

Android Mobile Ransomware: Bigger, Badder, Better?

Business Process Compromise

Business Email Compromise

Latest Ransomware Posts

Ransomware 101

Popular Posts

Stay Updated