Danny Palmer at ZDNet reported on a new scheme for aspiring cyber criminals that lets them into the ransomware racket for free, but at a steep 50/50 split with the people that provide them with the malicious code. We think that this will not be a major hurdle and that this strain that uses phishing with malicious attachments will take off in the very near future.
"A number of ransomware-as-a-service affiliate schemes allow even the most technically illiterate cyber thief to cash in on a form of crime which cost businesses over a billion dollars last year, and it's only the beginning, with file locking malware only set to grow and take a larger role in cybercrime, warn researchers.
This new ransomware operation is providing malicious software to affiliates for free in exchange for a big slice of any successful scores. The move represents another evolution in ransomware which could make it an even more dangerous threat, because criminals may be tempted to download it and launch a ransomware campaign as they don't need to part with their cash to do so."
Victims are infected with the Dot ransomware using malicious phishing attachments, which will encrypt their files when they run and open a ReadMe HTML, informing them they need to pay a Bitcoin ransom in order to regain access to their data.
"The simplistic and straight-forward design of Dot ransomware enables just about anyone to conduct cybercrime," warn Fortinet researchers, who predict Dot will soon become a big threat to businesses.
"Although we haven't seen this ransomware in the wild, with the advertisements being made accessible on hacking forums, it's only a matter of time until people start taking the bait."
The scheme reared up its ugly head mid-February and all the user needs to get started is to access to the download via the Tor browser and to register a Bitcoin address.
Once this is done, the Dot criminal coders allow a download with a getting started guide, including help which file types to use to distribute ransomware, and hints about the level of ransoms to charge in which countries. They provide a dashboard to keep track of the number and status of infections and the code is designed like normal modern software.
We've got something really cool for you: the new Phishing Security Test v2.0!
It's got several great new features, and sending simulated phishing emails to train your employees is a fun and an effective best practice to patch your last line of defense... your users.
The phish-prone percentage is usually higher than you expect and is great ammo to get budget. You can now find out the current Phish-prone percentage of your organization and who might infect your network with ransomware.
With Our Brand-New Phishing Test:
- You can customize the phishing test based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- Already did a phishing test in the past? For a limited time you can reset it yourself and do a new one.
Start phishing your users now. Fill out the form, and get started immediately. There is no cost.
Don't like to click on redirected buttons? Copy and paste this link in your browser:
