Forcepoint Security Labs observed Scarab ransomware being spread through the Necurs botnet. How do botnets like...
Necurs change the ransomware threat, and how should enterprises respond?
Botnets have become an important part of a standardized criminal infrastructure as attackers can use them for spam, phishing and distributed denial-of-service attacks. Some may even consider them a cloud hosting platform for criminals.
The different aspects of an attack that uses a botnet are often delegated or outsourced to individuals who specialize in certain areas -- from recruitment of bots to recruitment of money mules. This delegation of tasks can abstract the parts of a malware attack so that the attacker need only coordinate the different pieces versus needing the technical skills to complete them all. One active botnet that has been used to distribute ransomware is Necurs.
The Necurs botnet continues to distribute Locky and other malware, but it recently started distributing Scarab ransomware. Forcepoint noted that Scarab ransomware is similar to the Jaff ransomware, as it takes several steps to disable Windows recovery features, resulting in users being forced to pay a ransom if they want their files back.
Companies should have standard enterprise ransomware response steps, as well as standard malware protections for their email systems. Individuals and organizations should also back up their important data, as that may be the only option to recover from a ransomware attack or failed disk drive.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
After a comeback of the Russian-built VPNFilter botnet, home network devices are at risk. Learn how this malware targets victims with expert Nick ... Continue Reading
The TrickBot banking Trojan joined forces with IcedID to form a dual threat that targets victims for money. Discover how this union occurred and how ... Continue Reading
The Qihoo 360 Core Security team found a Microsoft vulnerability -- named Double Kill -- that affects applications via Office documents. Learn how ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.