• Locky is Back – Using Infected .pdf Email Attachments

    Home » Forums » Cyber Security Information and Advisories » Code Red – Security/Privacy advisories » Locky is Back – Using Infected .pdf Email Attachments

    Author
    Topic
    #110591


    The Godfather of Ransomware Returns: Locky is Back and Sneakier Than Ever

    After a mysterious disappearance, Locky has reemerged — and is borrowing attack techniques from Dridex.
    http://www.zdnet.com/article/the-godfather-of-ransomware-returns-locky-is-back-and-sneakier-than-ever/

    By Danny Palmer | April 24, 2017

     
    Just when you were getting over the shell-shock of the Shadow Brokers malware release impacts, now comes news that Locky has returned to foist ransomware on the unsuspecting.

    “The ransomware that drove last year’s boom in file-encrypting malware is back, and this time it’s even harder to detect.

    Ransomware cost its victims some $1bn during 2016, with Locky one of the most widespread variants, infecting organisations across the globe.

    But after being all but written off, Locky is staging a comeback…

    This time, however, the Locky campaign is harnessing an infection technique associated with the Dridex botnet, in an effort to boost the chance of compromising targets…

    this new form of Locky begins by using a familiar tactic — a phishing email with an attached file the message claims is a document detailing a payment or scanned documents. But rather than the more common practice of attaching a compromised Office document, an infected-PDF is sent instead.”

     
    Read more here

    Viewing 2 reply threads
    Author
    Replies
    • #110596

      Malwarebytes article discusses the Word document embedded in a .pdf (Dridex method), giving details of the exploits. It allows sandboxing to be bypassed!

      The attack relies on users opening up malicious attachments that will appear legitimate. Many studies have shown that users are often the weakest link in an attack chain and criminals know that too well.

      https://blog.malwarebytes.com/cybercrime/2017/04/locky-ransomware-is-back-but-we-already-protect-against-it/

      5 users thanked author for this post.
    • #110626

      The solution is simple!  Just don’t open email attachments from senders that you are not expecting them from!!!

       

      Windows 10 Pro 22H2

      • #110637

        For some businesses, that might just be easier said than done?

        1 user thanked author for this post.
    • #110906

      One of my clients uses the “new” advanced exchange protection add-on for their hosted enterprise plan on O365.  It’s supposed to open all attachments in a VM sandbox and check them for payloads before forwarding them to the end user.

      Today we observed two of these infected PDF files with embedded Word documents bypass that protection entirely.

      Grrrrr . . . .

      ~ Group "Weekend" ~

      4 users thanked author for this post.
    Viewing 2 reply threads
    Reply To: Locky is Back – Using Infected .pdf Email Attachments

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: