When the ransomwareLocky was first discovered in early 2016, it relied on a malicious macro embedded in Microsoft Word (MS) documents as its main distribution technique. After a brief campaign hiatus, a new variant of Locky (Detected by Trend Micro as PDF_LOCKY.A) has emerged that uses a macro-enabled Microsoft Word document nested within a PDF file as a new propagation method.
Like previous variants, Locky arrives via spam emails containing a PDF file attachment. The PDF file contains a *.docm (the extension used for documents containing macros) file attached. After the file is opened, the *.docm file containing the macro will continue to run alongside the code, disguised as a social engineering attack. One notable characteristic of this instruction is that it doesn’t match the UI—the mentioned buttons don’t actually exist.
The macro will then be executed, resulting in the download of the ransomware file from a Command & Control (C&C) server. The following files will then be placed in the user’s %temp% folder:
The list of targeted files and the .osiris affix are carried over from previous Locky variants. After the encryption routine finishes, the following ransom note will be displayed:
Image c/o Bleeping Computer
Few ransomware has had as much impact as the CERBER ransomware (detected by Trend Micro as RANSOM_CERBER family). In the amount of time since its first variants were discovered, the notorious ransomware has gone through several iterations—with each variant sporting additions such as anti-sandbox and anti-virus features.
These JS files are designed to perform three functions:
1) Download and execute the ransomware payload
2) Create a scheduled task that will run CERBER 6 after a two minute delay
3) Run and embedded PowerShell script.
Of these three functions, the second one is notable because it will allow CERBER to elude traditional sandbox detection. This variant also continues with the stealth ransomware theme, adding more checks for file extensions that it will avoid encrypting. In particular, CERBER can now utilize Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user’s computer, limiting both detection and mitigation capabilities of these applications. This development comes after it was found that CERBER has evolved to evade machine learning. The combination of these features makes the latest CERBER variant a much more stubborn ransomware to deal with.
Ransomware-as-a-Service(RaaS) has become a disturbing trend for both users and organizations, as cybercriminals with only perfunctory technical knowledge gain access to dangerous ransomware variants. Most RaaS ransomware are exactly that—services that cyber criminals can use, but do not grant access to the malware’s actual source code. However, a new ransomware kit called CradleCore (Detected by Trend Micro as Ransom_CRADLE.A) changes this model. This malware is being sold as a C++ source code with a relatively comprehensive set of features that include anti-sandbox evasion and offline encryption.
There is little information so far on how CradleCore spreads, but it is reasonable to assume that it propagates via typical ransomware methods such as spam and phishing attacks.
Once the ransomware has been downloaded and executed in a user’s computer, it will display a ransom note with the file name _HOW_TO_UNLOCK_FILES_.html. The note comes with a ransom demand for decryption worth 0.25 bitcoins, or roughly $300. Targeted files are also appended with a .cradle extension.
The ransomware found this week demonstrates new features while still relying on typical arrival methods such as spam and phishing. This indicates that the best practices used for identifying and mitigating these types of attacks are still relevant—and are still important measures that both users and organizations should continually practice to defend against these types of threats.
For small businesses, Trend Micro Worry-Free Services Advanced offers cloud-based email gateway security through Hosted Email Security. Its endpoint protection also delivers several capabilities such as behavior monitoring and real-time web reputation in order detect and block ransomware.
For home users, Trend Micro Security 10 provides strong protection against ransomware by blocking malicious websites, emails, and files associated with this threat.