Ransomware Recap: Locky Returns, Cerber Evolves Anew

Image c/o Bleeping Computer

CERBER 6

Few ransomware has had as much impact as the CERBER ransomware (detected by Trend Micro as RANSOM_CERBER family). In the amount of time since its first variants were discovered, the notorious ransomware has gone through several iterations—with each variant sporting additions such as anti-sandbox and anti-virus features.

The latest variant in the wild, CERBER 6, is similar to other CERBER variants in that it arrives via spam emails disguised as a courier delivery service. The email contains a zipped attachment alongside malicious javascript (JS) files.

These JS files are designed to perform three functions:

1)      Download and execute the ransomware payload

2)      Create a scheduled task that will run CERBER 6 after a two minute delay

3)      Run and embedded PowerShell script.

Of these three functions, the second one is notable because it will allow CERBER to elude traditional sandbox detection. This variant also continues with the stealth ransomware theme, adding more checks for file extensions that it will avoid encrypting. In particular, CERBER can now utilize Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user’s computer, limiting both detection and mitigation capabilities  of these applications. This development comes after it was found that CERBER has evolved to evade machine learning. The combination of these features makes the latest CERBER variant a much more stubborn ransomware to deal with.

CradleCore

Ransomware-as-a-Service(RaaS) has become a disturbing trend for both users and organizations, as cybercriminals with only perfunctory technical knowledge gain access to dangerous ransomware variants. Most RaaS ransomware are exactly that—services that cyber criminals can use, but do not grant access to the malware’s actual source code. However, a new ransomware kit called CradleCore (Detected by Trend Micro as Ransom_CRADLE.A) changes this model. This malware is being sold as a C++ source code with a relatively comprehensive set of features that include anti-sandbox evasion and offline encryption.

There is little information so far on how CradleCore spreads, but it is reasonable to assume that it propagates via typical ransomware methods such as spam and phishing attacks.

Once the ransomware has been downloaded and executed in a user’s computer, it will display a ransom note with the file name _HOW_TO_UNLOCK_FILES_.html. The note comes with a ransom demand for decryption worth 0.25 bitcoins, or roughly $300. Targeted files are also appended with a .cradle extension.

Conclusion

The ransomware found this week demonstrates new features while still relying on typical arrival methods such as spam and phishing. This indicates that the best practices used for identifying and mitigating these types of attacks are still relevant—and are still important measures that both users and organizations should continually practice to defend against these types of threats.