New Hybrid VirRansom: The AIDS of Ransomware on the Loose
KnowBe4 CEO Stu Sjouwerman issued a warning of a scary new strain of ransomware, one with a difference, this one is a true self-replicating parasitic virus called VirRansom. This new strain is a hybrid that combines CryptoLocker and http:// CryptoWall functionality with active self-replicating virus infections of all the files it can find. And like the cybercrime Reveton family of malware, it locks the PC's main screen demanding 0.619 Bitcoin to let you back in.
Sjouwerman stated, “This ransomware threat utilizes both ransomware and parasitic virus features. VirRansom is a full fledged virus which will spread across your network and doing a less than perfect job on the disinfection can easily lead to reinfection of your whole network. CryptoWall-encrypted files that you can't or don't decrypt are harmless garbage forever, but you can delete those. However, with VirRansom, files that you don't decrypt are still recoverable, but remain actively infectious.” Sjouwerman added; “What makes this tricky is the infected files can't just be deleted, since they are your own files that were there before the infection started.”
According to researchers at Sophos, most worms leave a handful of infected files that weren't there before and need to be deleted. Parasitic viruses, in contrast, may leave hundreds or thousands of infected files on each computer. If even one of those infected files are left behind after a clean-up, the infection will start up all over again.
The file encryption is not as advanced as CryptoWall. For now, the key to decrypt the files is contained in the malware itself. Most antivirus should soon be able to decrypt the files and restore them, but the bad guys are constantly changing encryption keys in which case antivirus vendors may not be able to solve this fast enough...
Sjouwerman cautioned, “Ransomware gets nastier all the time. We can expect a VirRansom 2.0 with "new features" like industrial-strength CryptoWall-like encryption where files are held hostage until payment is made and email server infections where emails are converted to a worm for maximum dissemination of their malicious code. The legal ramifications could be horrific.”
Sjouwerman suggests IT managers mitigate these types of threats through both technical measures and enforcing security policy, such as:
1. Test the Restore function of your backups and make sure it works and have a full set of backups offsite.
2. Start thinking about asynchronous real-time backups so you can restore files with a few mouse clicks.
3. Get rid of mapped drives and use UNC (universal naming convention) links for shared folders.
4. Look into Whitelisting software that only allows known-good executables to run.
5. Update or enforce security policy best practices, such as thorough effective security awareness training to prevent these types of infections to begin with, as the infection vector is your end-user opening up an attachment or clicking on a link.
About Stu Sjouwerman and KnowBe4
Stu Sjouwerman (pronounced “shower-man”) is the founder and CEO of KnowBe4, LLC, which provides web-based Security Awareness Training (employee security education and behavior management) to small and medium-sized enterprises. A data security expert with more than 30 years in the IT industry, Sjouwerman was the co-founder of Inc. 500 company Sunbelt Software, an award-winning anti-malware software company that he and his partner sold to GFI Software in 2010. Realizing that the human element of security was being seriously neglected, Sjouwerman decided to help entrepreneurs tackle cybercrime tactics through advanced security awareness training.
KnowBe4 services hundreds of customers in a variety of industries, including highly-regulated fields such as healthcare, finance and insurance and is experiencing explosive growth with a surge of 427% in 2013 alone. Sjouwerman is the author of four books, with his latest being Cyberheist: The Biggest Financial Threat Facing American Businesses.
For more information about Stu Sjouwerman and KnowBe4visit: http://www.KnowBe4.com/
About Kevin Mitnick
Kevin Mitnick is an internationally recognized computer security expert with extensive experience in exposing the vulnerabilities of complex operating systems and telecommunications devices. He gained notoriety as a highly skilled hacker who penetrated some of the most resilient computer systems ever developed. Today, Mitnick
Related News
As cybercrime increased with the spread of the COVID-19 pandemic and cyberwarfare became a hot topic following Russia’s attack on Ukraine, cryptocurrency increasingly became associated with illegal and criminal activities. It has become a significant part of the thriving of ransomware and other forms of cyber extortion. This perception is not new, as Chainalysis CTO […]
Ransomware, rogue software which encrypt data on your hard disk and demand payment in bitcoins to restore it, have been on the rise recently. Hospitals, police stations and universities have been the recent targets of ransomware. What exactly are the causes of the increase in ransomware and did Bitcoin lead to its birth? Craig Williams, Senior Technical Leader of Cisco Talo, says: “The ability to demand payment in bitcoinCT r: 8, a difficult-to-trace virtual currency not controlled by any country, was 'basically the birth of ransomware' and has helped drive its success since the currency's....
As technology advances, the use of new tools and blockchain ledger may put an end to the ransomware menace. Ransomware has been around since 1989 after Joseph Popp created the first malware known as AIDS or PC Cyborg. After 27 years, internet users are still finding themselves becoming targets to advanced versions of these malware which holds them for ransom by encrypting all the files on their computer. Almost all ransomware demand varying amounts in ransom to be sent in the form of bitcoin to the creator or distributor of the malware in order to get the decryption tool to regain access....
Growth Ecosystem, a primary DeFi cross-chain farming protocol, has finally launched on Avalanche, one of the world’s fastest-growing blockchain ecosystems. The Growth Ecosystem launched on November 13, with a revolutionary new hybrid bridge system for its incentives token, $WHEAT, as well as a self-repaying loan feature for its overcollateralized stable coin, $MOR on Avalanche. WHEAT is the Growth DeFi ecosystem’s incentive token, and it can be farmed organically by staking WHEAT, GRO, or MOR. It also plays an essential role in Growth DeFi’s new hybrid bridge product.....
Over the course of 2015, many individuals and companies have been affected by ransomware. While this may have nothing to do with Bitcoin at first glance, there have been a few cases where the ransomware could only be removed by paying a certain fee in Bitcoin. But those days may be over now, as a decryption toolkit for various types of ransomware has been made publicly available, free of charge. CryptoLocker and CoinVault Ransomware. Two types of ransomware making headlines all across the world in recent months are called CryptoLocker and CoinVault. Both types of ransomware operate, in the....