New strain of ransomware mimics Locky

Security researchers have discovered a new ransomware campaign targeting manufacturing and business service sectors in Western Europe.

The campaign, dubbed Hades Locker, was detected in emails containing hyperlinks to a Microsoft Word document named "levering-1478529.doc" on several websites with recently registered domains.

In a blog post, the firm said it suspected a connection to previous CryptFile2 and MarsJoke campaigns that Proofpoint and others have documented based on the sending botnet and the distribution techniques (transportation-related email lures). Visually, Hades Lucker mimics early versions of Locky.

In contrast with these previous campaigns directed at state and local government agencies, however, Hades Locker targets manufacturing and business services.

This malicious software alerted victims that their files were encrypted, by creating several types of files scattered throughout their file system.

"The ransom message is dropped to the victim's Desktop, as a text file, HTML file, and an image. The message urges the victim to "buy the decryption password belonging to your files." In order to do this, the victim is instructed to visit a web page or an onion site," the company said.

This website asks for one bitcoin (equivalent to 600 USD) in order to receive the decrypting software.

As a guarantee' that the decryption works, victims can also submit a single encrypted file and receive its decrypted version within 24 hours.

Proofpoint says: "Ransoms are increasing and actors are exploring new distribution methods such as links to hosted malware. As ransomware is increasingly commoditised and ransomware variants share features and aesthetics, we will continue to monitor the evolution of the market and its impact on businesses and individuals."