As if banking malware Dridex weren’t enough, a new ransomware tool called Locky — and likely supplied by the same cybercriminals behind Dridex — has started making the rounds. Employing the same kind of macro-based infection vector as Dridex, this new threat has already been detected in more than 400,000 sessions, indicating that despite the cutesy name, its makers are determined to get the most from their malicious code.
Here’s a rundown of Locky’s ugly side.
Ransomware’s Macro Malady
According to Naked Security, this new strain of ransomware typically arrives as a Word document. If opened, the text looks like random garbage, but it comes with a helpful message: Enable macro if the data encoding is correct. Of course, turning on macros doesn’t fix the data (since it’s all nonsense anyway) but instead saves a file to the hard drive. The file is a downloader that fetches Locky from its command-and-control (C&C) server.
Once on board, the ransomware scrambles and then encrypts all files, tagging them all with a *.locky extension. What’s more, any external media drives attached to a desktop are also compromised. The malware also deletes any Volume Snapshot Service (VSS) files or shadow copies made by Windows in site backups.
Finally, a new wallpaper pops up that directs users on exactly how to reclaim their lost files — either through specific Web addresses or by using the Tor browser. Right now, decryption keys run between 0.5 and 1 bitcoin, or $200 to $400. So far, the ransomware has focused its efforts in the U.S., but it has also targeted firms in Canada and Australia.
Open Sesame!
So how can organizations stay safe from Locky? Regular off-site backups always help, along with the use of Microsoft Office viewers that let users see attached documents without actually opening them first. It’s also a good idea to limit login power and restrict the number of admin users on a system since the malware can only reach as far as user privileges allow. By enabling user account control (UAC) and keeping permissions to a minimum, it’s possible to limit the damage of a ransomware attack.
As noted by CSO Online, however, there may be another way to solve the problem of already-infected users: disrupting its key exchange. Unlike similar malware, which generates a random encryption key on the compromised computer and then sends this data back to base, Locky does it the other way by generating a key with its C&C infrastructure that is then sent to victim PCs. If infection is caught early enough, it may be possible to interrupt this process and prevent the encryption of critical files.
Bottom line? Locky is riding the macro-driven malware trend and can mean big disruptions for unsuspecting companies. Don’t let the name fool you — this one is out for blood.