Security Market Segment LS
Wednesday, 17 February 2016 15:00

Dridex diversifies into Ransomware Featured

By

The operators of the virulent financial Trojan Dridex have branched out into Ransomware – they hope to get ‘Locky’.

Proofpoint, a next-generation security company, found the malware on 16 February. Its researchers found new ransomware named ‘Locky’ being distributed via MS Word documents containing malicious macros.

It stands out because it is being delivered by the same actor behind many of the Dridex campaigns (iTWire report here) tracked over the last year.

In this campaign, messages from random senders with the subject "ATTN: Invoice J-12345678" deliver an attachment "invoice_J-12345678.doc". The attachments are MS Word documents containing macros which download and install the Locky ransomware. The botnet (a group of infected machines running a spam bot) delivering the spam is the same botnet that distributes the vast majority of messages bearing the Dridex banking Trojan.

The ransomware encrypts files based on their extension and uses notepad to display the ransom message. It also replaces the Desktop background with the ransom message. If the user visits the onion (or tor2web) links specified in the ransom message, they are instructed to buy Bitcoins, send them to a certain Bitcoin address, and then refresh the page to wait for the decryptor download. There is no guarantee that the key will be provided if you pay.

At this stage antivirus company coverage is limited and once encrypted you will lose your files unless you have recent backup.

It is mainly aimed at corporate targets. Sysadmins should check to see if there are .locky extension files on network shares. If so, look at the owner in the on_Locky_recover_instructions.txt file in each folder. Then lock the owners Active Directory user and computer account immediately and take them off the network. The only cure is to rebuild the PC from scratch.

Sysadmins should disable Microsoft Office running macros by default. This will also protect against Dridex.


Subscribe to ITWIRE UPDATE Newsletter here

GRAND OPENING OF THE ITWIRE SHOP

The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

INTRODUCING ITWIRE TV

iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

BACK TO HOME PAGE
Ray Shaw

joomla stats

Ray Shaw ray@im.com.au  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments