New Locky Variant Lukitus Distributed in 23 Million Emails

Figure 1. Lukitus infection diagram

Lukitus either arrives as an email with a ZIP compressed attachment that contains a Visual Basic Script (VBS) or JavaScript file (detected as JS_NEMUCOD.TH822 and JS_NEMUCOD.ELDSAUJM), a Microsoft Word document, or a spoofed Dropbox notification. The operators behind Lukitus were discovered sending spams that contain common subjects like "please print,” "documents,” "photo,” "images,” "scans," and "pictures.”

Spam was the top infection vector among the ransomware threats we detected and blocked in 2016, accounting for 79 percent of the total. It is highly recommended for users and enterprises to have an email security solution that checks for email reputation, web reputation of the embedded links, file attachments, as well as macros in Microsoft Office documents.

In addition, users and enterprises can adopt these best practices to lower or eliminate the risk of ransomware infection.

Solutions

Enterprises can benefit from a multi-layered, step-by-step approach in order to best mitigate the risks brought by these threats. Email and web gateway solutions such as Trend Micro™ Deep Discovery™ Email Inspector and InterScan™ Web Security prevent ransomware from ever reaching end users. At the endpoint level, Trend Micro Smart Protection Suites deliver several capabilities like high-fidelity machine learning, behavior monitoring and application control, and vulnerability shielding that minimizes the impact of this threat. Trend Micro Deep Discovery Inspector and Deep Discovery Analyzer detect ransomware on networks, while Trend Micro Deep Security™ stops ransomware from reaching enterprise servers–whether physical, virtual or in the cloud. Trend Micro products’ use of Predictive Machine Learning also protects environments from unidentified threats and zero-day attacks. It performs a behavioral analysis on unknown or low-prevalence processes to determine if an emerging or unknown threat like Lukitus is attempting to infect your network.

For small businesses, Trend Micro Worry-Free Services Advanced offers cloud-based email gateway security through Hosted Email Security. Its endpoint protection also delivers several capabilities such as behavior monitoring and real-time web reputation in order detect and block ransomware. 

For home users, Trend Micro Security 10 provides strong protection against ransomware by blocking malicious websites, emails, and files associated with this threat.