Nasty New Hybrid Strain of Ransomware

KnowBe4 CEO Stu Sjouwerman issued a warning of a scary new strain of ransomware, one with a difference, this one is a true self-replicating parasitic virus called VirRansom. This new strain is a hybrid that combines CryptoLocker and CryptoWall functionality with active self-replicating virus infections of all the files it can find. And, like the cybercrime Reveton family of malware, it locks the PC's main screen demanding 0.619 Bitcoin to let you back in.

Sjouwerman stated, “This ransomware threat utilizes both ransomware and parasitic virus features. VirRansom is a full-fledged virus which will spread across your network and doing a less than perfect job on the disinfection can easily lead to reinfection of your whole network. CryptoWall-encrypted files that you can't or don't decrypt are harmless garbage forever, but you can delete those. However, with VirRansom, files that you don't decrypt are still recoverable, but remain actively infectious.”  Sjouwerman added; “What makes this tricky is the infected files can't just be deleted, since they are your own files that were there before the infection started.”

According to researchers at Sophos, most worms leave a handful of infected files that weren't there before and need to be deleted. Parasitic viruses, in contrast, may leave hundreds or thousands of infected files on each computer. If even one of those infected files is left behind, after a clean-up, the infection will start up all over again.

The file encryption is not as advanced as CryptoWall. For now, the key to decrypt the files is contained in the malware itself. Most antivirus should soon be able to decrypt the files and restore them, but the bad guys are constantly changing encryption keys in which case antivirus vendors may not be able to solve this fast enough..

Sjouwerman cautioned, “Ransomware gets nastier all the time. We can expect a VirRansom 2.0 with "new features" like industrial-strength CryptoWall-like encryption where files are held hostage until payment is made and email server infections where emails are converted to a worm for maximum dissemination of their malicious code.  The legal ramifications could be horrific.”

Sjouwerman suggests IT managers mitigate these types of threats through both technical measures and enforcing security policy:

1. Test the Restore function of your backups and make sure it works and have a full set of backups offsite.

2. Start thinking about asynchronous real-time backups so you can restore files with a few mouse clicks.

3. Get rid of mapped drives and use UNC (universal naming convention) links for shared folders.

4. Look into Whitelisting software that only allows known-good executables to run.

5. Update or enforce security policy best practices, such as thorough effective security awareness training to prevent these types of infections to begin with, as the infection vector is your end-user opening up an attachment or clicking on a link.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.