Locky Ransomware Fuels Surge in .RAR, JavaScript Attachments

[steven36]

Locky malware, currently one of the most active ransomware threats, has influenced a transition to new types of attachments used in malicious emails, Trend Micro researchers warn.

 

 

 

Ransomware often distributed via spam emails, especially now that the notorious Angler Exploit Kit (EK) is gone, and Locky appears responsible for a surge of certain delivery methods, researchers say. According to Trend Micro, 71% of known ransomware families arrive via email.

 

During the first half of the year, 58% of ransomware threats came from email attachments, the security company notes. File types used by attackers to deliver their malicious payloads include JavaScript, VBScript, and Office files with macros, all coded in ways meant to evade detection from traditional security solutions.

 

Email is a tried-and-tested method for malware delivery and is particularly effective when targeting enterprises and small and medium businesses (SMBs). Locky’s operators have been using this delivery method from the beginning, but they switched between various types of email attachments to ensure increased efficiency for their attacks.

 

Trend Micro security researchers explain that, on the one hand, this continuous switch between email attachments contributed to Locky’s prevalence, while on the other the increase in the use of certain file types in email attachments was influenced by this ransomware family alone.

 

“The first two months of the year, we spotted a spike in the use of .DOC files in spam emails. DRIDEX, an online banking threat notable for using macros, was, at one point, reported to be distributing Locky ransomware. From March to April, we saw a spike in the use of .RAR attachments, which is also attributed to Locky,” researchers say.

 

Locky switched to JavaScript attachments in June and August, but researchers note that ransomware families such as CryptoWall 3.0 and TeslaCrypt 4.0 are using this technique as well. Locky was also seen using VBScript attachments, and it switched to Windows Scripting file (WSF) attachments around mid-July to August. Also in August, FireEye Labs researchers observed Locky reverting to malicious macros in Office docs attached to spam emails.

 

Most recently, Locky was seen using DLLs and .HTA file attachments for distribution, and researchers forecast that attackers will also adopt executable files such as .COM, .BIN, and .CPL for malware distribution purposes. Because many of these file types aren’t normally used to deliver malware, cybercriminals can more easily avoid detection.

 

“To block spam emails with JS, VBScript, WSF and HTA attachments, companies should use email solutions with different anti-spam filters such as heuristics and fingerprint technology.  In addition, solutions with blacklisting mechanism can block known malicious sender IPs. To detect macro downloaders by Locky and Cerber, email solutions should have macro scanning feature that can detect any malicious macro components of threats,” Trend Micro researchers say.

 

The spam emails used to deliver ransomware usually contain common subject lines and employ social engineering to determine victims to execute the malicious files. Emails with subject lines that involve invoices, parcel delivery, confirmation of order, banking notifications, and payment receipts should be considered suspicious, the security researchers say.

 

Source:

http://www.securityweek.com/locky-ransomware-fuels-surge-rar-javascript-attachments

 

 

[straycat19]

Any security officer worth his salt will have all attachments on email removed prior to allowing them into an individuals email box.  We provide an FTP server for files that need to be sent to us so we can scan them and test them in a sandbox before notifying the recipient that they have a file on the server.  Actual detection of files containing malware using this system has been less than one in a million.  It appears that most the script kiddies are too lazy to find and upload files to an FTP server.  Of course, other checks are also made before the files can be uploaded, such as is it coming from an authorized IP.  There are those who will say that IPs can be spoofed, but really, what IP are they going to spoof, since they don't know which ones are authorized.  In the realm of possibilities, it is possible I would show up at your door in the middle of the night with a team to confiscate your computer and electronic equipment, but how realistic is that?  Anything is possible but most people are lazy and won't do anything that really requires any original thinking or much work.  That's why they are script kiddies.