Security researchers have discovered a new ransomware campaign targeting manufacturing and business service sectors in Western Europe.
The campaign, dubbed Hades Locker, was detected in emails containing hyperlinks to a Microsoft Word document named "levering-1478529.doc" on several websites with recently registered domains.
In a blog post, the firm said it suspected a connection to previous CryptFile2 and MarsJoke campaigns that Proofpoint and others have documented based on the sending botnet and the distribution techniques (transportation-related email lures). Visually, Hades Lucker mimics early versions of Locky.
In contrast with these previous campaigns directed at state and local government agencies, however, Hades Locker targets manufacturing and business services.
This malicious software alerted victims that their files were encrypted, by creating several types of files scattered throughout their file system.
"The ransom message is dropped to the victim's Desktop, as a text file, HTML file, and an image. The message urges the victim to "buy the decryption password belonging to your files." In order to do this, the victim is instructed to visit a web page or an onion site," the company said.
This website asks for one bitcoin (equivalent to 600 USD) in order to receive the decrypting software.
As a guarantee' that the decryption works, victims can also submit a single encrypted file and receive its decrypted version within 24 hours.
Proofpoint says: "Ransoms are increasing and actors are exploring new distribution methods such as links to hosted malware. As ransomware is increasingly commoditised and ransomware variants share features and aesthetics, we will continue to monitor the evolution of the market and its impact on businesses and individuals."
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
