What makes Locky and Cerber ransomware so good - and what about CradleCore?

Since its discovery last year, the Locky ransomware has become one of the most notable forms of malware on the scene, constantly updating itself but still managing to use the same general distribution methods. And it shows no sign of going away, according to Trend Micro.

The company posted a blog this month in which it compared Locky tactics to those of the equally formidable Cerber ransomware - and how they have both evolved.

Locky has been on and off the radar, but the latest variant uses a Microsoft Word document with macros enabled to deliver its load.  Spam email spread a PDF file attachment. This attachment contains the macro-enable file, which then runs when a victim opens the file.

Meanwhile the Cerber ransomware is proving to be a more prevalent and difficult malware to deal with. It has evolved several times and has managed to defeat many sandboxes and antiviruses, including machine learning tools.

The latest version of the ransomware is spread through spam emails disguised as a courier delivery service, Trend Micro says.

Malicious Javascript files hide in the attachment, with three main functions: download and execute Cerber, create a scheduled task that runs the ransomware after two minutes, and runs an embedded PowerShell Script.

Trend Micro says that the fact that Cerber is able to use stealth and launch after a two minute delay means that is can dodge traditional sandboxes.

It is also able to use "Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user's computer, limiting both detection and mitigation capabilities  of these applications," the Trend Micro blog states.

The company is also quick to point out that Ransomware-as-a-Service (RaaS) traditionally prevented users from accessing the source code, but a new kit called CradleCore is changing all of that.

It is being sold as C++ source code that features anti-sandboxing and offline encryption. It demands around 0.25 Bitcoins as a ransom.

While Trend Micro says that little is known about the CradleCore ransomware, the company suspects that because it is still distributed by spam and phishing, it shows the power of those delivery methods.