Saturday, December 2, 2023

Massive Locky Ransomware Campaign Over 23 Million Messages sent in 24 hours

Locky Ransomware has a piece of a history of going silent and growing back all of a sudden.Security experts at Appriver detected this new campaign.

In span of 24 hours over 23 million messages sent out in the attack, which makes it one of the biggest malware campaign in latter half of 2017.

Locky Ransomware

Security experts detected this campaign on 28 August around 7 am CST.Email consist of any one of the following in subject lines.

  • please print
  • documents
  • photo
  • images
  • scans
  • pictures

Also Read Locky Ransomware spreading through Facebook Messenger Via SVG File

Each message accompanies a ZIP attachment that has a Visual Basic Script (VBS) document that is settled inside an arbitrary ZIP record. Once clicked, VBS record starts a downloader that connects with greatesthits[dot]mygoldmusic[dotcom] to pull down the most recent Locky Ransomware.
Locky Ransomware

Locky goes to work encoding every one of the records on the objective framework and adding [.]lukitus to the clients now encrypted files.Once all the victims documents have been encrypted by the attackers leave decoding guidelines by changing the desktop background to a picture with directions and additionally a HTML files on the desktop suitably named “Lukitus[dot]htm“.

Before this Comodo Threat Intelligence labs detected another variant of locky on August 19th as an attachment is an archive file, with the name “E 2017-08-09 (580).vbs.The attachement consist of a new member of the locky familiy IKARUSdilapidated.

Attackers uses social Engineering tricks to make the victims done as instructed which results in downloading the Trojan which encrypts the files.

Fatih Orhan, VP of Comodo Threat Intelligence Labs said “This latest ransomware phishing attack that commenced on August 9th was unique in its combination of sophistication and size, with botnet and over 11 thousand IP addresses from 133 countries involved in just the first stage of the attack.”

“Also he added When artificial intelligence couldn’t identify these unknown files, the full resources of the lab were needed to analyze and identify the code in the file and render a verdict”


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles