Ransomware Recap: Sept. 23, 2016

Businesses in Australia and New Zealand were recently in the crosshairs of ransomware attacks involving Crysis (detected by Trend Micro as Ransom_CRYSIS.A), a family first seen in February of 2015. Last week, Trend Micro researchers noted how this particular ransomware family has been taking on new targets via remote desktop protocol (RDP) brute force attacks—a behavior first observed in August.

According to the researchers, this a deviation from the common infection vectors utilized by this ransomware family. Crysis has been previously known to arrive as an infected attachment with double file extensions to mask the malware, and distributed in various spam campaigns or via embedded links to compromised websites.

[Related: Ransomware and spam]

However, the use of brute-forced RDPs, has been seen as a lucrative option for operators. Researchers discovered Crysis used in attacks that involve brute-forced RDP credentials with the ransomware executed through a redirected drive coming from the source machine.

Crysis attacks weren't the first time cybercriminals leveraged RDPs in ransomware attacks. Past incidents show that the method has already been used by those targeting businesses. In October 2015, perpetrators behind LowLevel04 ransomware (detected by Trend Micro as Ransom_LEVELO.A) reportedly brute-forced RDP credentials before manually downloading and installing the malware in the target’s systems. Just like Crysis, it has the capability of scanning mapped networks and removable drives and then encrypting files found in them.

Here are the other notable ransomware stories from the past week:

While newer families and updated variants continue to make news, a multi-layered approach that safeguards all possible gateways of compromise should be protected, as the best way to prevent ransomware from entering the network. Maintaining regular backups of important files is also the best way to mitigate the damage caused by a ransomware infection.

Ransomware Solutions