The onset of Locky Ransomware campaign was thought to be evolutionary, but around the clock the campaign has grown to be revolutionary.
We had been monitoring and sharing Locky campaign updates since last month till date. It was observed that almost 23 million messages were sent in last 24-hour period, making it one of the largest malware campaigns seen in the latter half of 2017.
Ransom Notes From Locky Ransomware
The other day 711 million addresses were found to be leaked onto the internet by Online Spambot. The profound dump had found coherencies with recent Locky malspam activities.
The analysis of the thousands of emails sent in the campaign revealed this attack data: 11,625 different IP addresses in 133 different countries are being used to perform this campaign and also Spreading via spoofing Dropbox.
The countries housing the most attack servers are Vietnam, India, Mexico, Turkey, and Indonesia.
The evolution focused on changing tactics mid-game and experimenting with new extensions or new baits to get unsuspecting users to click.
The late August campaign uses the IKARUS dilapidated version of Locky, which had the .lukitus extension. It spreads using a botnet of zombie computers responsible for coordinating a phishing attack.
While some of the campaigns were also seen spreading with a ZIP attachment that contains a Visual Basic Script (VBS) file that is nested inside a secondary ZIP file.
Once clicked, VBS file initiates a downloader that reaches out to the malicious domain to pull down the latest Locky ransomware.
Additional capricious characteristics included the malicious documents exhibiting harmless behavior in many sandboxes while still infecting end users.
In the latest spam run, the ransomware infection has been resorted to spoofing Dropbox. And accessing the malicious dropbox websites drops Locky payload.
C&C Server Communication for Download Locky Ransomware
Recently we had seen in HoeflerText camapaign, website generates a bogus popup message informing the user the webpage they are trying to view cannot display correctly because the browser is missing the correct “HoeflerText” font.
The message then prompts the user to fix the error. When clicked, receives a JavaScript file which is designed to download and install Locky ransomware
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…