Criminals behind the Dridex and Locky malware have launched new ransomware that zips up victims' files in a password-protected archive.
Hackers are using the RockLoader malware to download a new ransomware, called Bart, over HTTPS, according to a blog post from IT security firm Proofpoint. Its researchers said that Bart has a payment screen like Locky but encrypts files without first connecting to a command and control (C&C) server.
The firm said that last Friday its researchers detected a large campaign with .zip attachments containing JavaScript code. If opened, these attachments download and install the intermediary loader RockLoader, which in turn downloads Bart.
It said that messages in this campaign had the subjects "Photos" with the attachment "photos.zip", "image.zip", "Photos.zip", "photo.zip", "Photo.zip", or "picture.zip." The zip files contained JavaScript file such as "PDF_123456789.js."
Bart then informs victims that their files are being encrypted by the ransomware and turned into two types of files, a method similar to many other types of ransomware. Specifically, it drops a recover.txt into many folders and replaces the desktop background with an image file giving information to the victim about how they can pay a ransom and get their files back.
The ransom note displays in multiple languages depending on the user's system language. It has translations available in Italian, French, German, and Spanish. The malware also uses the system's language to avoid infecting systems of Russian, Ukrainian, and Belorussian users.
"This first campaign appears to largely be targeting US interests but, given the global nature of Locky and Dridex targeting and the available translations for the recovery files, we do not expect Bart to remain this localised," the researchers said.
The ransom note urges the user to visit a payment portal in order to pay three bitcoins (just under $2,000 at current exchange rates).
The ransomware does not appear to have any network communication mechanism with a command and control server. Instead, the necessary information about infected machine is likely passed to the payment server in the URL "id" parameter.
According to Proofpoint, the malware is using the open source WProtect for code virtualisation.
The researchers warned that Bart may be able to encrypt PCs behind corporate firewalls that would otherwise block such traffic.
"Organisations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables," the researchers said.
-
What is polymorphic malware?Explainer Polymorphic malware constantly changes its code to avoid detection, making it a top cybersecurity threat that demands advanced, behavior-based defenses
-
Outgoing Kaseya CEO teases "this is just the beginning" for the companyOpinion We spoke to Fred Voccola who remains a key figurehead at the firm as it enters its next chapter...
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reportedNews Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
