Massive LOCKY Campaign Targets Millions of Users

After a recent spam campaign that saw LOCKY being dropped along with FAKEGLOBE, a potentially larger campaign is underway, using spam emails to infect users with a LOCKY ransomware variant (Detected by Trend Micro as RANSOM_LOCKY.TH918).  As of the time of this publication, the number of spam emails that were sent already number in the millions.

The campaign uses different types of spam emails. The first one is a fake email, allegedly sent by the Multi-Level Marketing (MLM) Company Herbalife International, in which a tax invoice for a supposed order placement is sent to the user in the form of a file archive:

Figure 1: “Herbalife” spam email sample

The second spam email also uses a malicious archive to deliver the malware. However, it comes with a generic “copier” sender without any other indication as to what the spam email is about:

Figure 2: “copier” spam email sample

A third spam email involving LOCKY was also used in the campaign, this time allegedly sent by a “voicemail” service:

Figure 3: “vmservice” spam email sample

These spam emails all come with an archive file that uses a .7z extension. Contained within these files is a malicious VBS (Detected by Trend Micro as MAL_VBSCRDLX) that, when executed by the user, downloads the LOCKY ransomware.

Trend Micro Smart Protection Network (SPN) data revealed that Chile was the main target of the “Herbalife” spam attacks, hitting Chile (41%) and Japan (21%). The “copier” spam attacks hit India (18%),  followed by the US (17%) and Japan (14%). The “vmservice” attacks followed the same patterns, with India at the top (24%), followed by the US (13%) and Japan (12%).

The full coverage for the attacks can be seen in the Heat Maps below:

Figure 4: Top 10 countries affected by the “copier” attacks. Apart from India, US, and Japan, "copier" spam attacks were also seen in Mexico, Russia, and China.

Figure 5: Top 10 countries affected by the “Herbalife” attacks. Chile and Japan, were the main countries involved, followed by China, India and Mexico.

Figure 6: Top 10 countries affected by the “vmservice” attack. India, US and Japan make up the three top countries affected, followed by Mexico, China and Russia.

The different spam emails also peaked at different times, with the “copier” spam sending out the most spam mail from the afternoon of September 18 to early morning September 19. It started to intensify at 4pm UTC time, or 9:30pm in India, which was the country most affected by the attacks.. This was followed by the “Herbalife” spam, which was most prominent from the morning of September 19 and continued through the night. The third spam email, involving “vmservice”, started on the afternoon of September 20 and lasted until September 21. Interestingly, this attack also started peaking at 4PM UTC—similar to the “copier” attacks.

Figure 6: Hourly timeline for the different LOCKY spam attacks. All times are in UTC+0

Spam is still an effective attack vector

While the behavior of LOCKY itself remains unchanged, the scope of the attack and the rapidness with which it managed to spread points to effectiveness of spam for propagating ransomware.  LOCKY itself has had a history of being delivered via spam, as seen in previous campaigns such as the one involving the Brazilian underground market, as well as the campaign using encrypted DLLs.

To protect their systems from spam and phishing attacks, users are recommended to use the following best practices:

• Users should always double-check the legitimacy of an email by checking identifiers such as sender domains as well proper spelling and grammar.
• For organizations, proper implementation of antispam filters will help filter threats coming from malicious sources

• Users should always take the context of an email or message into account. If they receive an email from an unfamiliar company or individual, or if they receive invoices for purchases they did not make, then this should be a red flag.

• As a general rule, users should avoid clicking on links or download files even if they come from seemingly “trustworthy” sources without verifying first.