Ransomware Recap: Dark Web Ransomware Economy on Fire

According to a security firm’s research, 2017 has seen a 2,502 percent growth in the ransomware dark web economy. The same research also found over 6,300 places where cybercriminals had advertised ransomware services, along with over 45,000 ads.

The researchers that delved into the dark web for ransomware operators or ransomware related services found that the dark web's ransomware economy grew from $249,287.05 in 2016 to $6,237,248.90 in 2017. The booming ransomware economy can be attributed to the emergence of Bitcoin for ransom payment, and the obscure nature of Tor, which helps cybercriminals mask their illegal activities. Since the transaction flow of Bitcoin is almost untraceable, identifying the account holder is nearly impossible. These two factors have allowed ransomware operators to hide underground, ultimately contributing to the growing ransomware economy.

In addition, the research also finds ransomware entrepreneurs earning as much as $100,000 yearly by selling their product. That amount is a far cry from the roughly $69,000 that legitimate software developers earn, according to figures from PayScale.com.

Here are the other notable ransomware stories:

WannaCry and CTB-Locker Sold in the Middle Eastern and North African Underground

Critroni or Curve-Tor-Bitcoin (CTB) Locker or CTB-Locker ransomware was also seen being peddled in a Turkish underground forum by a Russian cybercriminal going by the handle Fizik. This malware notably utilizes elliptic curve cryptography instead of the commonly used RSA or AES. Moreover, CTB-Locker uses Tor to mask its C&C communications to hide from law enforcement agencies.

Locky’s Mean Streak

Figure 2. Screenshot of the Locky-carrying spam email

Another variant was also discovered arriving in spam emails that contain HTML attachments. The email subject is about a delivered invoice, with a message that tells the recipient to open the attached file. The HTML attachment has the filename of 'A_[Random Numbers].html', and is already detected as 'HTML_IFRAME.YYRU.’

BTCWare 

A new BTCWare ransomware variant is reportedly making the rounds, targeting victims by hacking into poorly protected remote desktop services and then manually installing the ransomware. Appending encrypted files with a .[email]-id-id.payday extension name, this variant uses a new key generation feature that makes the affected files impossible to crack.

Figure 3. BTCWare ransom note

BTCWare’s ransom note advises victims to pay a certain amount in bitcoin to regain access to the encrypted files; the specific price will depend on how fast they write to the ransomware operator. The note also warns victims to avoid attempting to decrypt their files with the help of third parties as it could increase the amount of the ransom payment.

Ender and Polsky

Figure 4. Ender ransom note

Meanwhile, Polsky (detected as Ransom_POLSKY.A) is a new ransomware variant written in Polish. Encrypting files via the AES-256 algorithm, Polsky demands $100 for the necessary decrypt key. The variant also warns that the ransom payment will double to $200 if the ransom is not paid within four days.