Post Now

Locky’s Dormancy Period Ends, New Variant Reappears To Create A Global Ransomware Epidemic!

Image

Locky ransomware, a deadly malware, reappeared in India through a massive spam campaign creating a global ransomware epidemic, followed by a dormancy period after the previous attack in February 2016. The government of India has issued an ‘Alert’ on the s

Locky ransomware, a deadly malware, reappeared in India through a massive spam campaign creating a global ransomware epidemic, followed by a dormancy period after the previous attack in February 2016. The government of India has issued an ‘Alert’ on the spread of new variant of Locky Ransomware.Locky ransomware locks computers and demands a ransom to unlock similar to other types of ransomware like NotPetya/ WannaCry.   "Alert regarding spam spreading Locky ransomware issued today by @IndianCERT...," Ajay Kumar (Electronics and IT Additional Secretary)  tweeted on September 2. According to latest reports, Locky has established its presence over eight companies within Delhi and more than two lakh emails have been reported. No more reports are out yet giving details on the severity of attacks of now. Locky demands ransom in crypto currency, i.e., half Bitcoin (Rs. 1.5 Lakh). The alert issued on Cyber Swachhta Kendra:“It has been reported that a new wave of spam mails are circulating with common subject lines to spread variants of Locky ransomware. Reports indicate that over 23 million messages have been sent in this campaign. The messages contain common subjects like please print, documents, photo, Images, scans, and pictures. However, the subject texts may change in targeted spear phishing campaigns”. The alert also included: The messages contain "zip" attachments with Visual Basic Scripts (VBS) embedded in a secondary zip file. The VBS file contains a downloader which polls to domain "greatesthits[dot]mygoldmusic[dot]com" (please do not visit this malicious website) to download variants of Locky ransomware. When a system is infected by Locky ransomware, it gets encrypted with random numbers with "extension [dot] lukitus or [dot] diablo6".  This is different from the earlier attacks of the Locky ransomware which had the extension “.locky” to the encrypted files. “The instructions contain the installation of "a TOR browser and visiting (dot) onion sites and demanding a ransom of .5 Bitcoins", the alert added. Reports confirm that spams showing links to fake dropbox websites are being used to spread Locky variants to infect the target users. The alert also informed the readers that if the pages are viewed in Chrome or Firefox, they show a fake notification stating “you don't have the HoeflerText font”. These fake notifications had an "update" button that returns a malicious JavaScript (.js) file. Users are advised to exercise caution while opening emails and organizations are advised to deploy anti spam solutions and update spam block lists. What is a Ransomware?A variant of malicious malware/software designed to block access to a computer system or encrypts system files and demands a sum of money, i.e., ransom in cryptocurrencies like Bitcoin.What do you know about Locky Ransomware?The Locky ransomware is similar to other malware like WannaCry, Petya that caused massive global attack around the world during the middle of this year. It scrambles the contents of a computer or server (associated network shares, both mapped and unmapped and removable media) and demands ransom/ a sum of money to unlock it usually by cryptocurrency BITCOINS".Characteristics:

  • Domain Generation Algorithm (DGA)
  • Mapped / Unmapped Network share discovery
  • Restore point deletion
The contents of the original files in the infected system are encrypted with an extension “.locky” using a RSA-2048 and AES-1024 algorithm. The victim has no other way out other than paying the ransom. The new variant in circulation this year has the "extension [dot] lukitus or [dot] diablo6".History of Locky RansomwareLocky first reported in February 2016, the Hollywood Presbyterian Medical Center in Los Angeles, California. The entire system was encrypted keeping the hospital staff away from computers and accessing electronic medical records. The Hospital was helpless and paid a ransom of 40 bitcoins - then equivalent to $17,000 - to receive the decryption key to unlock and restore its data. By November,2016 Locky proliferated and became one of the most common malwares in the cyberspace. But Locky opted for a Christmas break in December 2016 and reemerged in January 2017 as tiny forms. Researchers predict that this period of inactivity has given time for criminals to update the malware and circulate the new strains of Locky - Diablo and Lukitus. This strain was out massively through spam email campaign across the world. Therefore, when Locky disappears next time, don’t relax but be prepared for a much stronger attack.Locky’s Route Map to Infect a SystemLocky infects a system via spammed Email. The mail contains attachments in the form of a MACRO enabled Microsoft Office document file with catchy subjects similar to ATTN: Invoice J-98223146 / invoice_J-12345678.doc / Rechnung-54-110090.xls.Once Macros is enabled unknowingly, the locky is downloaded, stored in Temp folder and then executed. Once installation process is completed, it starts to scramble file system with extensions .pptx, .pptm, .dotm,etc. Locky then renames the files in to [unique_id][identifier].locky. Locky deletes the ‘volume shadow copy files’ so that the possibility of restoring the system to an earlier steady state by "vssadmin.exe Delete Shadows /All /Quiet is brushed off.Major File System Changes
  • Files created %temp%.exe
  • %user Desktop%/_Locky_recover_instructions.bmp
  • %user Desktop%/_Locky_recover_instructions.txt
Indicators of Compromise:(Block the below malicious domains/IPs at the perimeter)
  • greatesthits[dot]mygoldmusic[dot]com
  • files with extension “ [.]lukitus” or “[.]diablo6”
  • file Win[.]JSFontlib09[.]js
  • hxxp://geocean.co[.]id/657erikftgvb??pGDIWEKDHD=pGDIWEKDHD
  • Locky ransomware post-infection URL: hxxp://46.183.165.45/imageload.cgi
Is there a tool to decrypt files infected with Locky?No. Researchers/ Industry experts have not found a tool yet. The only way to decrypt locked files is to pay the ransom.Basic Recommendations to protect your Computer :
  • Back up your files.
  • Use an antivirus program.
  • Be suspicious of unknown emails and websites.
  • Perform regular backups of all critical data stored on your computer.
  • Never pay the ransom.
Countermeasures By CERT-In :Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:
    • Perform regular backups. Ideally, this data should be kept on a separate device, and backups should be stored offline.
    • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
    • Maintain updated Antivirus software on all systems
    • Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through the browser.
    • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
    • Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
    • Check regularly for the integrity of the information stored in the databases.
    • Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
    • Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
    • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
    • Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
    • Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
    • Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
    • Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
    • Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
    • Additional Security measures that may be considered are
      • Use RDP Gateways for better management
      • Change the listening port for Remote Desktop
      • Tunnel Remote Desktop connections through IPSec or SSH
      • Two-factor authentication may also be considered for highly critical systems
    • If not required, consider disabling PowerShell / windows script hosting.
    • Restrict users' abilities (permissions) to install and run unwanted software applications.
    • Enable personal firewalls on workstations.
    • Implement strict External Device (USB drive) usage policy.
    • Employ data-at-rest and data-in-transit encryption.
    • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
    • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
    • Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
    • Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee that files will be released.
    • Report such instances of fraud to CERT-In and Law Enforcement agencies