Kaspersky has a fascinating blog post on a new strain of ransomware called RAA that is not only fairly sophisticated, but incredibly abusive:Long story short, this bundle of nastiness encrypts your files and then, adding insult to injury, drops a variant of the well-known and much-dreaded Pony info-stealer trojan to sweep up credentials and compromise whatever accounts it can.
This RAA variant is delivered via a zipped, password-protected .JS file nearly 3000 lines in length. When it's first opened it looks like a Microsoft Word document to trick victims. The .JS file is itself a minor wonder, as it contains not only....
- An implementation of the DLL CryptoJS (itself an implementation of the RSA encryption process), but ...
- An .RTF file (stored in base64 and displayed to distract the user while the malcode does its business in the background), as well as ...
- Pony itself (a PE file stored, again, in base64 within the script itself, which is dropped and executed after the file encryption process completes).
It's the infamous Ginsu knives approach ("But wait, there's more...") brought to the world of malware.
Yikes.
The infection vector for RAA ransomware has been mostly spear phishing emails targeted at corporate users. They are likely using the Pony stealer for one to gain access to contact lists that increase the success of new attacks, but the stealer also searches for passwords, FTP credentials, and much more.
See all the technical details for this strain at Kaspersky's blog.
Free Phishing Security Test
Did you know that 91% of successful data breaches started with a spear-phishing attack?
Cyber-attacks are rapidly getting more sophisticated. We help you train your employees to better manage the urgent IT security problems of social engineering, spear-phishing and ransomware attacks. Take the first step now. Find out what percentage of your employees are Phish-prone™ with our free test. Did you know that KnowBe4 also supports "Vishing" where you can actually send your users simulated voice mail attacks?
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
