Security researchers say a new brand of ransomware called Locky has borrowed a technique from the Dridex banking...
malware. What is the Dridex malware technique and what elements of Locky make it different from other types of ransomware?
The Locky ransomware continues to improve its attack capabilities. Fortinet blogged about updates they identified in recent versions of the malware. Locky ransomware has incorporated a domain name generating algorithm to improve the resilience of the command-and-control (C&C) communications. Locky also incorporated an update to the C&C where the communications are minimally encrypted to prevent analysis over the network. Adding this functionality required significant efforts by the malware authors. Given how the malware is regularly updated with new functionality incorporating new attack techniques, this might suggest an experienced cybercriminal operation instead of low-skilled hackers.
The Locky ransomware appears to have borrowed the initial idea for the domain generation algorithm (DGA) from the Dridex malware. The DGA uses the infected machine's year, month, day as well as seed values. This makes it possible to predict the domains Locky will register, and to sinkhole those domains in advance. Researchers at Forcepoint Security Labs analyzed an updated sample of the Locky ransomware that has a significantly improved DGA without the previous shortcomings.
Even though the Locky ransomware has incorporated functionality for DGA into the malware, it still has a backup IP address used for C&C of the botnet. The C&C encrypted communication was broken by Fortinet and could be detected over the network. Fortinet also released indicators of compromise for the C&C systems and indicators that a local computer should be checked to identify whether the system is infected, if the files had not yet been encrypted.
Ask the Expert: Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Find out how Dridex redirection attacks work
Learn about the effectiveness of ransomware vaccines against Locky
Read about links between arrested Russian hackers and ransomware shutdowns
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can ... Continue Reading
CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about ... Continue Reading
The use of botnets to spread Scarab ransomware intensifies the threat for enterprises. Discover the best way to respond to such a threat and protect ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.