new crypto locker makes its victims spread the virus

While getting to a least privilege model is not a quick fix, it’s possible to reduce exposure quickly by removing unnecessary global access groups from access control lists. In addition to offering a line of defense for malware, it will mitigate potential exposure to other attacks from both internal and external actors. Restricting access is therefore a prudent course of action, as it will limit the scope of what can be encrypted. The more files a user account has access to, the more damage malware can inflict. For example, a variant known as “CTB-Locker” creates a single file in the directory where it first begins to encrypt files, named, !Decrypt-All-Files-.TXT or !Decrypt-All-Files-.BMP. Instruction file names are typically DECRYPT_INSTRUCTION.txt or DECRYPT_INSTRUCTIONS.html.Īs new variants are uncovered, information will be added to the Varonis Connect discussion on Ransomware. Finally, the malware creates a file in each affected directory linking to a web page with decryption instructions that require the user to make a payment (e.g. On execution, CryptoLocker begins to scan mapped network drives that the host is connected to for folders and documents ( see affected file-types), and renames and encrypts those that it has permission to modify, as determined by the credentials of the user who executes the code.ĬryptoLocker uses an RSA 2048-bit key to encrypt the files, and renames the files by appending an extension, such as. Ransomware has evolved as more of a targeted attack instead of the previous wide distribution model, and is still a threat to businesses and government entities. CryptoLocker and it’s variants are no longer in wide distribution, and new ransomware has taken over.

Update September 2018: Ransomware attacks have decreased significantly since their peak in 2017. If you’re interested in reading about ransomware in general, we’ve written A Complete Guide To Ransomware that is very in-depth. Free Video Course on Securing Microsoft Teams and 365įYI, this article is CryptoLocker specific.

New crypto locker makes its victims spread the virus