sb-as logo
Story image

What makes Locky and Cerber ransomware so good - and what about CradleCore?

10 May 2017

Since its discovery last year, the Locky ransomware has become one of the most notable forms of malware on the scene, constantly updating itself but still managing to use the same general distribution methods. And it shows no sign of going away, according to Trend Micro.

The company posted a blog this month in which it compared Locky tactics to those of the equally formidable Cerber ransomware - and how they have both evolved.

Locky has been on and off the radar, but the latest variant uses a Microsoft Word document with macros enabled to deliver its load.  Spam email spread a PDF file attachment. This attachment contains the macro-enable file, which then runs when a victim opens the file.

Meanwhile the Cerber ransomware is proving to be a more prevalent and difficult malware to deal with. It has evolved several times and has managed to defeat many sandboxes and antiviruses, including machine learning tools.

The latest version of the ransomware is spread through spam emails disguised as a courier delivery service, Trend Micro says.

Malicious Javascript files hide in the attachment, with three main functions: download and execute Cerber, create a scheduled task that runs the ransomware after two minutes, and runs an embedded PowerShell Script.

Trend Micro says that the fact that Cerber is able to use stealth and launch after a two minute delay means that is can dodge traditional sandboxes. 

It is also able to use “Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user’s computer, limiting both detection and mitigation capabilities  of these applications,” the Trend Micro blog states.

The company is also quick to point out that Ransomware-as-a-Service (RaaS) traditionally prevented users from accessing the source code, but a new kit called CradleCore is changing all of that. 

It is being sold as C++ source code that features anti-sandboxing and offline encryption. It demands around 0.25 Bitcoins as a ransom.

While Trend Micro says that little is known about the CradleCore ransomware, the company suspects that because it is still distributed by spam and phishing, it shows the power of those delivery methods. 

Story image
Hackers offering forged “official” COVID vaccination certificates and negative test results on dark net 
There has been a 350% increase in the number of advertisements selling alleged COVID vaccines within the last three months.More
Story image
Cybersecurity budgets still not keeping up with threats — report
Executive teams are failing to recognise the level of damage cyber-threats pose to organisations, according to Sophos — many of them taking a ‘conservative approach’ to cybersecurity expenditure.More
Story image
rhipe acquires emt Distribution, with aim to expand into enterprise market
The acquisition will enable rhipe to deliver a comprehensive portfolio of end-to-end security capabilities to its partners, the company says.More
Story image
Pandemic sees organisations of all sizes and industries invest in CTI
There is opportunity for organisations to better manage their cyber-threat intelligence for greater security and threat intelligence effectiveness by adopting the right tools and processes.More
Story image
Need for greater understanding of data security responsibility as cloud adoption grows - report
Despite the accelerated adoption of cloud services, there was a lack of clarity and confidence regarding the protection and recovery of data stored in public clouds.More
Story image
Almost a third of malware threats previously unknown - HP report
A new report has found 29% of malware captured was previously unknown due to the widespread use of packers and obfuscation techniques by attackers seeking to evade detection. More