Forcepoint Security Labs observed Scarab ransomware being spread through the Necurs botnet. How do botnets like...
Necurs change the ransomware threat, and how should enterprises respond?
Botnets have become an important part of a standardized criminal infrastructure as attackers can use them for spam, phishing and distributed denial-of-service attacks. Some may even consider them a cloud hosting platform for criminals.
The different aspects of an attack that uses a botnet are often delegated or outsourced to individuals who specialize in certain areas -- from recruitment of bots to recruitment of money mules. This delegation of tasks can abstract the parts of a malware attack so that the attacker need only coordinate the different pieces versus needing the technical skills to complete them all. One active botnet that has been used to distribute ransomware is Necurs.
The Necurs botnet continues to distribute Locky and other malware, but it recently started distributing Scarab ransomware. Forcepoint noted that Scarab ransomware is similar to the Jaff ransomware, as it takes several steps to disable Windows recovery features, resulting in users being forced to pay a ransom if they want their files back.
Companies should have standard enterprise ransomware response steps, as well as standard malware protections for their email systems. Individuals and organizations should also back up their important data, as that may be the only option to recover from a ransomware attack or failed disk drive.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can ... Continue Reading
CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about ... Continue Reading
After a fake WhatsApp app was discovered in the Google Play Store, users are questioning what can be done to avoid counterfeit apps. Learn several ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.