Nasty New Hybrid Strain of Ransomware

KnowBe4 CEO Stu Sjouwerman issued a warning of a scary new strain of ransomware, one with a difference, this one is a true self-replicating parasitic virus called VirRansom. This new strain is a hybrid that combines CryptoLocker and CryptoWall functionality with active self-replicating virus infections of all the files it can find. And, like the cybercrime Reveton family of malware, it locks the PC's main screen demanding 0.619 Bitcoin to let you back in.

Sjouwerman stated, “This ransomware threat utilizes both ransomware and parasitic virus features. VirRansom is a full-fledged virus which will spread across your network and doing a less than perfect job on the disinfection can easily lead to reinfection of your whole network. CryptoWall-encrypted files that you can't or don't decrypt are harmless garbage forever, but you can delete those. However, with VirRansom, files that you don't decrypt are still recoverable, but remain actively infectious.”  Sjouwerman added; “What makes this tricky is the infected files can't just be deleted, since they are your own files that were there before the infection started.”

According to researchers at Sophos, most worms leave a handful of infected files that weren't there before and need to be deleted. Parasitic viruses, in contrast, may leave hundreds or thousands of infected files on each computer. If even one of those infected files is left behind, after a clean-up, the infection will start up all over again.

The file encryption is not as advanced as CryptoWall. For now, the key to decrypt the files is contained in the malware itself. Most antivirus should soon be able to decrypt the files and restore them, but the bad guys are constantly changing encryption keys in which case antivirus vendors may not be able to solve this fast enough..

Sjouwerman cautioned, “Ransomware gets nastier all the time. We can expect a VirRansom 2.0 with "new features" like industrial-strength CryptoWall-like encryption where files are held hostage until payment is made and email server infections where emails are converted to a worm for maximum dissemination of their malicious code.  The legal ramifications could be horrific.”

Sjouwerman suggests IT managers mitigate these types of threats through both technical measures and enforcing security policy:

1. Test the Restore function of your backups and make sure it works and have a full set of backups offsite.

2. Start thinking about asynchronous real-time backups so you can restore files with a few mouse clicks.

3. Get rid of mapped drives and use UNC (universal naming convention) links for shared folders.

4. Look into Whitelisting software that only allows known-good executables to run.

5. Update or enforce security policy best practices, such as thorough effective security awareness training to prevent these types of infections to begin with, as the infection vector is your end-user opening up an attachment or clicking on a link.

Featured

  • Unlocking the Possibilities

    Security needs continue to evolve and end users are under pressure to address emerging risks and safety concerns. For many, that focus starts with upgrading perimeter openings and layering technologies—beginning at the door. Read Now

  • Freedom of Choice

    In today's security landscape, we are witnessing a fundamental transformation in how organizations manage digital evidence. Law enforcement agencies, campus security teams, and large facility operators face increasingly complex challenges with expanding video data, tightening budget constraints and inflexible systems that limit innovation. Read Now

  • Accelerating a Pathway

    There is a new trend touting the transformational qualities of AI’s ability to deliver actionable data and predictive analysis that in many instances, seems to be a bit of an overpromise. The reality is that very few solutions in the cyber-physical security (CPS) space live up to this high expectation with the one exception being the new generation of Physical Identity and Access Management (PIAM) software – herein recategorized as PIAM+. Read Now

  • Protecting Your Zones

    It is game day. You can feel the crowd’s energy. In the parking lot. At the gate. In the stadium. On the concourse. Fans are eager to party. Food and merchandise vendors ready themselves for the rush. Read Now

  • Street Smarts

    The ongoing acceptance of AI and advanced data analytics has allowed surveillance camera technology to shift from being a tactical tool to a strategic business solution. Combining traditional surveillance technology with AI-based data-driven insights can streamline transportation systems, enhance traffic management, improve situational awareness, optimize resource allocation and streamline emergency response procedures. Read Now

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.