Monthly Archives: December 2016

KillDisk: from disk-wiping to ransomware

CyberX reports that KillDisk, already associated with cybersabotage, is now also being used as a basis for ransomware, demanding a hefty 222 bitcoin in ransom.

NEW KILLDISK MALWARE BRINGS RANSOMWARE INTO INDUSTRIAL DOMAIN

Commentary by Catalin Cimpanu for Bleeping Computer: KillDisk Disk-Wiping Malware Adds Ransomware Component.

Commentary by David Bisson for Tripwire: KillDisk Wiper Malware Evolves into Ransomware.

David Harley

Malware distributed as fake security software

An article by Catalin Cimpanu for Bleeping Computer: It’s Almost 2017 and Users Are Still Getting Infected with Malware via Fake AV Software includes instances of a Remote Access Trojan and ransomware distributed as fake security software including Goldeneye/Petya and Stampado.

David Harley

Smart TV Hit by Android Ransomware

Software engineer Darren Cauthon tweeted about how: ‘Family member’s tv is bricked by Android malware. #lg wont disclose factory reset. Avoid these “smart tvs” like the plague.’

To put this into some perspective, this isn’t a recent model: he explains that ‘It was one of the first google tvs.’ (Google TV is no longer supported, and LG smart TVs now run on WebOS, apparently. However, Google is said to be working on another Android-based platform.)

Catalin Cimpanu reports for Bleeping Computer that ‘Cauthon says he tried to reset the TV to factory settings, but the reset procedure available online didn’t work.’ When contacted, it seems that LG suggested that an engineer could reset the TV at a cost of $340. Cimpanu suggests that the malware is probably FLocker (a.k.a. Dogspectus).

Commentary by David Bisson for MetaCompliance here.

David Harley

CryptXXX: free decryptor or discount? Hmm…

I see there is much excitement in the media about CryptXXX’s ‘Christmas discount’, the ransom having been reduced from 1.2 bitcoin to 0.5 until the end of December. Of more significance is the fact that Kaspersky have once more been able to update their Rannoh decryptor to handle CryptXXX version 3. Available from directly from Kaspersky or from NoMoreRansom.org.

Commentary from The Register – Don’t pay up to decrypt – cure found for CryptXXX ransomware, again – and from SC Media, in an article with some interesting commentary from industry stalwarts such as Anton Ivanov and Paul Ducklin, even though most of the story is about the ‘discount’.

David Harley

No More Ransom: new partners

The ‘No More Ransom‘ site has quietly added a number of ‘Associated’ and ‘Supporting’ partners. For SecurityWeek, Kevin Townsend explains the difference/partner hierarchy, and quotes a number of industry figures (including me, at some length): No More Ransom Alliance Gains Momentum.

It’s good news, but I think there’s more they could do.

David Harley

Malwarebytes makes VinCEmeat of screen locker

Interesting analysis from Pieter Arntz for Malwarebytes of the VinCE screen locker, intended to persuade the victim into calling the ‘helpline’ number the malware displays. An example of malware that illustrates an almost imperceptible distinction between a tech support scam and true ransomware.

A closer look at a tech support screen locker

This AVIEN article also added to Tech Support Scams and Ransomware, to Specific Ransomware Families and Types,  and to PC ‘Tech Support’  Scam Resources. The latter has now been renamed by dropping the reference to cold-calls, as cold-calling is no longer the only (or, arguably, the most effective) means of implementing tech support scams.

David Harley