The Necurs botnet, which had been dormant for a few weeks, began to once again distribute malware-riddled spam...
emails. The new campaign delivers downloaders for Locky ransomware, which has anti-sandboxing and evasion techniques. What should organizations know about the Necurs botnet, and how can they prevent Locky infections from occurring?
Malware authors have to constantly update their malware to keep one step ahead of the antimalware industry. The Necurs botnet was one of the largest botnets before it went dormant. It is a peer-to-peer hybrid botnet and uses a domain generation algorithm (DGA) as part of its command-and-control (C&C) communication, along with using signed commands to ensure that only the legitimate operator of the botnet can control it.
The Necurs botnet distributes other malware and is used in distributed denial-of-service attacks. Necurs primarily distributed the Locky ransomware and the Dridex banking Trojan in its spam emails. The revived Necurs botnet sends out a new variant of the Locky ransomware with added anti-virtual machine and evasion techniques. Necurs may have gone dormant while the malware authors were updating the C&C infrastructure or waiting for a new variant of the Locky ransomware.
Enterprises should know that the Necurs botnet can be detected by monitoring for the C&C infrastructure indicated by DGA connections and looking out for spam; Proofpoint's Q3 Threat Summary report showed that a whopping 97% of malicious document attachments sent during the quarter contained Locky. Proofpoint released indicators of compromise that can be used to detect the Locky ransomware. Enterprises can prevent Locky infections from occurring by following standard guidance on protecting endpoints from malware, including antispam and antiphishing measures to prevent people from opening the malicious attachments distributing the malware.
Ask the Expert: Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Learn how a Locky ransomware attack uses DGA
Discover why the majority of the companies hit with ransomware do not pay
Find out how to detect the Dridex banking Trojan
Dig Deeper on Email and Messaging Threats-Information Security Threats
Related Q&A from Nick Lewis
Researchers developed aIR-Jumper, an exploit that leverages lights within security cameras to extract data. Learn how this attack works and how to ...continue reading
The com.google.provision virus reportedly targets Android users, but little is known about it. Nick Lewis discusses the mystery threat and how Common...continue reading
A bug in Microsoft's Internet Explorer update exposes information that users enter into the browser's address bar. Learn more about the bug and URL ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.