Blog Layout

New Locky ransomware: what you need to know

Detangle IT • Aug 30, 2017
New Locky ransomware: what you need to know

In 2016, the Locky ransomware infected millions of users with a Microsoft Word file. It was eventually contained, and cyber security firms have since created protections to detect and block previous Locky variants. However, a similar malware is currently spreading worldwide and has so far infected tens of thousands of computers.

Quick facts

According to a threat intelligence report, the email-based ransomware attacks started on August 9 and were detected through 62,000 phishing emails in 133 countries in just three days. It also revealed that 11,625 IP addresses were used to carry out the attacks, with the IP range owners consisting mostly of internet service providers and telecom companies.

How it works

The malicious email contains an attachment named “E 2017-08-09 (580).vbs” and just one line of text. Like the original Locky authors, attackers responsible for the new variant deploy social engineering tactics to scam recipients into opening the attached .doc, zip, pdf, .jpg or tiff file, which installs the ransomware into their systems.

When an unsuspecting user downloads the file, the macros run a file that provides the encryption Trojan with an entry point into the system. The Trojan then encrypts the infected computer’s files.

Once encryption is completed, the user receives instructions to download the Tor browser so they can access the "dark web" for details on how to pay the ransom. To retrieve their encrypted files, users will be asked to pay from 0.5-1 Bitcoin.

What you need to do

This ransomware variant builds on the strengths of previous Trojans. In fact, the original Locky strain made it easy for cyber criminals to develop a formidable ransomware that could evade existing cyber security solutions. This is why adopting a "deny all" security stance, whereby all files are considered unsafe until proven otherwise, is the best way to avoid infection.

Here are other tips to avoid infection:

  • Don’t open unsolicited attachments in suspicious emails. Alert your IT staff, and most importantly disallow macros in Microsoft Office unless they’ve been verified by your IT team.
  • Performing regular backups guarantees you never have to pay cyber criminals a ransom. If all other security measures fail, you can always rely on your backups, which protect your business not just from cyber crime-related disasters, but also from natural and other unforeseen system failures.
  • Train your staff to identify online scams like phishing. This and other similar ransomware strains take advantage of users’ lack of cyber security training.
  • Update your operating systems as soon as updates become available to reduce, or eliminate, the chances of your system’s vulnerabilities being exploited.

Even with a trained staff and the latest protections installed, your IT infrastructure may still have unidentified security holes. Cyber security experts can better evaluate your entire infrastructure and recommend the necessary patches for your business’s specific threats. To secure your systems, get in touch with our experts now.

By Detangle IT 20 Jul, 2020
Scanning the files you download is not enough to detect malware these days. Hackers have found a clever way to get around antivirus and anti-malware software by using fileless malware. Since this malware is not as visible as traditional malware, it can infect your entire infrastructure without you even knowing. Let’s take a closer look […]
By Detangle IT 15 Jul, 2020
Viruses and malware creators are out to attack anyone and everyone, including Mac users. Despite Apple’s robust macOS that makes it difficult to attack Macs, cybercriminals are finding ways to identify and exploit vulnerabilities. Read on to find out which threats you should protect your Mac against, as well as signs that your computer has […]
By Detangle IT 03 Jul, 2020
Like people, websites also need to be dressed for success. Here’s how you can make yours look impressive and have visitors eager to do business with you. Make a statement with professional photographs Before site visitors read what’s on your website, they assess it by checking out your images. A picture is indeed worth a […]
SHOW MORE
Share by: