Graeme Dawes - Fotolia
Forcepoint Security Labs observed Scarab ransomware being spread through the Necurs botnet. How do botnets like Necurs change the ransomware threat, and how should enterprises respond?
Botnets have become an important part of a standardized criminal infrastructure as attackers can use them for spam, phishing and distributed denial-of-service attacks. Some may even consider them a cloud hosting platform for criminals.
The different aspects of an attack that uses a botnet are often delegated or outsourced to individuals who specialize in certain areas -- from recruitment of bots to recruitment of money mules. This delegation of tasks can abstract the parts of a malware attack so that the attacker need only coordinate the different pieces versus needing the technical skills to complete them all. One active botnet that has been used to distribute ransomware is Necurs.
The Necurs botnet continues to distribute Locky and other malware, but it recently started distributing Scarab ransomware. Forcepoint noted that Scarab ransomware is similar to the Jaff ransomware, as it takes several steps to disable Windows recovery features, resulting in users being forced to pay a ransom if they want their files back.
Companies should have standard enterprise ransomware response steps, as well as standard malware protections for their email systems. Individuals and organizations should also back up their important data, as that may be the only option to recover from a ransomware attack or failed disk drive.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Port scans provide data on how networks operate. In the wrong hands, this info could be part of a larger malicious scheme. Learn how to detect and ... Continue Reading
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading