Criminals behind the Dridex and Locky malware have launched new ransomware that zips up victims' files in a password-protected archive.
Hackers are using the RockLoader malware to download a new ransomware, called Bart, over HTTPS, according to a blog post from IT security firm Proofpoint. Its researchers said that Bart has a payment screen like Locky but encrypts files without first connecting to a command and control (C&C) server.
The firm said that last Friday its researchers detected a large campaign with .zip attachments containing JavaScript code. If opened, these attachments download and install the intermediary loader RockLoader, which in turn downloads Bart.
It said that messages in this campaign had the subjects "Photos" with the attachment "photos.zip", "image.zip", "Photos.zip", "photo.zip", "Photo.zip", or "picture.zip." The zip files contained JavaScript file such as "PDF_123456789.js."
Bart then informs victims that their files are being encrypted by the ransomware and turned into two types of files, a method similar to many other types of ransomware. Specifically, it drops a recover.txt into many folders and replaces the desktop background with an image file giving information to the victim about how they can pay a ransom and get their files back.
The ransom note displays in multiple languages depending on the user's system language. It has translations available in Italian, French, German, and Spanish. The malware also uses the system's language to avoid infecting systems of Russian, Ukrainian, and Belorussian users.
"This first campaign appears to largely be targeting US interests but, given the global nature of Locky and Dridex targeting and the available translations for the recovery files, we do not expect Bart to remain this localised," the researchers said.
The ransom note urges the user to visit a payment portal in order to pay three bitcoins (just under $2,000 at current exchange rates).
The ransomware does not appear to have any network communication mechanism with a command and control server. Instead, the necessary information about infected machine is likely passed to the payment server in the URL "id" parameter.
According to Proofpoint, the malware is using the open source WProtect for code virtualisation.
The researchers warned that Bart may be able to encrypt PCs behind corporate firewalls that would otherwise block such traffic.
"Organisations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables," the researchers said.
-
Trump's AI executive order could leave US in a 'regulatory vacuum'News Citing a "patchwork of 50 different regulatory regimes" and "ideological bias", President Trump wants rules to be set at a federal level
-
TPUs: Google's home advantageITPro Podcast How does TPU v7 stack up against Nvidia's latest chips – and can Google scale AI using only its own supply?
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
