Story image

What makes Locky and Cerber ransomware so good - and what about CradleCore?

10 May 2017

Since its discovery last year, the Locky ransomware has become one of the most notable forms of malware on the scene, constantly updating itself but still managing to use the same general distribution methods. And it shows no sign of going away, according to Trend Micro.

The company posted a blog this month in which it compared Locky tactics to those of the equally formidable Cerber ransomware - and how they have both evolved.

Locky has been on and off the radar, but the latest variant uses a Microsoft Word document with macros enabled to deliver its load.  Spam email spread a PDF file attachment. This attachment contains the macro-enable file, which then runs when a victim opens the file.

Meanwhile the Cerber ransomware is proving to be a more prevalent and difficult malware to deal with. It has evolved several times and has managed to defeat many sandboxes and antiviruses, including machine learning tools.

The latest version of the ransomware is spread through spam emails disguised as a courier delivery service, Trend Micro says.

Malicious Javascript files hide in the attachment, with three main functions: download and execute Cerber, create a scheduled task that runs the ransomware after two minutes, and runs an embedded PowerShell Script.

Trend Micro says that the fact that Cerber is able to use stealth and launch after a two minute delay means that is can dodge traditional sandboxes. 

It is also able to use “Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user’s computer, limiting both detection and mitigation capabilities  of these applications,” the Trend Micro blog states.

The company is also quick to point out that Ransomware-as-a-Service (RaaS) traditionally prevented users from accessing the source code, but a new kit called CradleCore is changing all of that. 

It is being sold as C++ source code that features anti-sandboxing and offline encryption. It demands around 0.25 Bitcoins as a ransom.

While Trend Micro says that little is known about the CradleCore ransomware, the company suspects that because it is still distributed by spam and phishing, it shows the power of those delivery methods. 

New threat rears its head in new malware report
Check Point’s researchers view Speakup as a significant threat, as it can be used to download and spread any malware.
Oracle updates enterprise blockchain platform
Oracle’s enterprise blockchain has been updated to include more capabilities to enhance development, integration, and deployment of customers’ new blockchain applications.
Used device market held back by lack of data security regulations
Mobile device users are sceptical about trading in their old device because they are concerned that data on those devices may be accessed or compromised after they hand it over.
Gartner names ExtraHop leader in network performance monitoring
ExtraHop provides enterprise cyber analytics that deliver security and performance from the inside out.
Symantec acquires zero trust innovator Luminate Security
Luminate’s Secure Access Cloud is supposedly natively constructed for a cloud-oriented, perimeter-less world.
Palo Alto releases new, feature-rich firewall
Palo Alto is calling it the ‘fastest-ever next-generation firewall’ with integrated cloud-based DNS Security service to stop attacks.
The right to be forgotten online could soon be forgotten
Despite bolstering free speech and access to information, the internet can be a double-edged sword, because that access to information goes both ways.
Opinion: 4 Ransomware trends to watch in 2019
Recorded Future's Allan Liska looks at the past big ransomware attacks thus far to predict what's coming this year.