Brad Duncan for Palo Alto: “Blank Slate” Campaign Takes Advantage of Hosting Providers to Spread Ransomware.
Palo Alto call it ‘Blank Slate’ because the malicious attachment is distributed via a blank email (spoofed sender and no message content).
Apparently primarily distributes Cerber, but also Sage 2.0 and Locky.
Zeljka Zorz reports for Help Net Security: Decrypter for Locky-mimicking PowerWare ransomware released – Palo Alto Networks’ researchers have created a decrypter for the variant of the PoshCoder ransomware that imitates the Locky ransomware. Josh Grunzweig’s decryptor is a Python script available here.
Zeljka points out ‘They can try following these instructions on Python.com on how to run a Python script on Windows, or ask someone more knowledgeable to help them clean their machine up.’
Added to the relevant resources page here.
Palo Alto describes how a Unit 42 analyst dealt with a traditional cold-call support scammer. Nothing earth-shatteringly unusual as far the scamming methodology is concerned, but useful analysis nonetheless.
Robert Falcone and Simon Conant: Don’t Be an April Fool: Inside a Common Phone Scam
[Updated 7th March 2016:
According to a ComputerWorld story, (and confirmed elsewhere) Apple has revoked the certificate of the compromised version of BitTorrent client Transmission and updated Xprotect.]
Palo Alto reported on March 6th that New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer: they believe this to be ‘the first fully functional ransomware seen on the OS X platform.’ At any rate, it looks like a capable piece of malware. According to fortune.com, Palo Alto plans ‘to release a blog advising Mac users on ways to check to see if they were infected with the virus and steps they can take to protect against it harming their data’.
Info also added to the Mac Virus blog and the AVIEN ransomware resource page. More info as the story develops, if time allows.