We recently observed a fresh malicious spam campaign pushed through the Necurs botnet distributing so far, two new variants of Locky ransomware.
In our last Q2 2017 report on tactics and techniques, we mentioned that Locky ransomware had reappeared with a new extension, but went dark again for months.
From August 9th, Locky made another reappearance using a new file extension “.diablo6” to encrypt files with the rescue note: “diablo6-[random].htm“.
Today a new Locky malspam campaign is pushing a new Locky variant that adds the extension “.Lukitus” and the rescue note: “lukitus.html“.
Locky, like numerous other ransomware variants, is usually distributed with the help of spam emails containing a malicious Microsoft Office file or a ZIP attachment containing a malicious script.
Locky variants, callback to a different command and control server (C2) and use the affiliate id: AffilID3 and AffilID5.
Over the last few months, Locky has drastically decreased its distribution, even failed to be distributed at all, then popped back up again, vanished and reappeared once more.
The ups and downs of Locky remain shrouded in mystery. One thing time has taught us is that we should never assume Locky is gone simply because it’s not active at a particular given time.
Locky extension history
Aug-09: MalSpam attached .zip with .vbs malware.
Aug-11: MalSpam attached PDF with embedded .DOCM files.
Aug-14: MalSpam attached RAR with .JS malware.
Aug-15: MalSpam attached ZIP with .JS malware.
Aug-16: MalSpam attached ZIP with .JS malware.
Malwarebytes protects against this attack at various layers including macro and ransomware mitigation, and neither of those required any signature update.
Click to view slideshow.
The post Locky ransomware returns to the game with two new flavors appeared first on Malwarebytes Labs.
Click here for best antivirus and antispyware software
Powered by WPeMatico