RIG exploit kit distributes Princess Ransomware

We have identified a new drive-by download campaign that distributes the Princess Ransomware, leveraging compromised websites and the RIG exploit kit. This is somewhat of a change for those tracking malvertising campaigns and their payloads. We had analyzed the Princess Ransomware last November and pointed out that despite similarities with Cerber’s onion page, the actual … [Read more…]

Locky ransomware adds anti sandbox feature

By Marcelo Rivero and Jérôme Segura The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments. Malwarebytes … [Read more…]

Locky ransomware adds new anti sandbox feature

By Marcelo Rivero and Jérôme Segura The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containing .VBS or .JS attachments. Malwarebytes … [Read more…]