Security Advisory – New Ransomware Variant Locky 2017.docx

Criticality
High

Affected Versions/Systems/Devices
Windows

Affected Regions

Global


Detailed Summary:

It has been reported that a new wave of spam mails are circulating with common subject lines to spread variants of Locky ransomware. Reports indicate that over 23 million messages have been sent in this campaign. The messages contain common subjects like "please print", "documents", "photo", "Images", "scans" and "pictures". However, the subject texts may change in targeted spear phishing campaigns.
The messages contain "zip" attachments with Visual Basic Scripts (VBS) embedded in a secondary zip file. The VBS file contains a downloader which polls to domain "greatesthits[dot]mygoldmusic[dot]com" (please do not visit this malicious website) to download variants of Locky.
The emails were botnet-based, and they came from various IP addresses around the world. The message-ID header was spoofed so that it ended with @us-west-2.amazonses.com>.
Please find below sample spoofed header:
Date/Time start: Thursday 2017-08-31 as early as 23:50 UTC
Date/Time finish: Friday 2017-09-01 as late as 01:41 UTC
Sender (spoofed): "Dropbox" <no-reply@dropbox.com>
Subject: Please verify your email
Executive Summary Several security researchers have discovered a new type of malware that jumps onto the Ransomware bandwagon, encrypting victims' files and then demanding a payment of half a Bitcoin for the key. Named "Locky," the malware depends on a rather low-tech installation method to take root in a user's system: it arrives courtesy of a malicious macro in a Word document.
Security Advisory – (20170903) New Ransomware Variant Locky 2017.docx
When we try to open link it will present with option to update font. This page is design to execute “Win.JSFontlib09.js”. That JavaScript file is designed to download and install Locky ransomware.
Shown below: Bogus site with a HoeflerText popup when viewing it in Chrome.
Please find below screenshot after infection of Locky.
If the system is infected by Locky all files are encrypted and string with random numbers with extension “ [.]lukitus” or “[.]diablo6” is appended to the encrypted files. It may be noted that earlier variants of Locky add extension “.locky” to the encrypted files. After encryption, desktop background is changed with instructions and a “htm” file with a name “Lukitus[dot]htm”. The instructions contain installation of TOR browser and visiting “.onion” sites and demanding ransom of “.5 Bitcoins”
It is also reported that a spam campaign showing links to fake dropbox sites is being used to spread Locky variants.
If the pages are viewed in Chrome or Firefox, they show a fake notification stating “you don't have the HoeflerText font”. These fake notifications had an "update" button that returns a malicious JavaScript (.js) file.
Users are advised to exercise caution while opening emails and organizations are advised to deploy anti spam solutions and update spam block lists.
As with previous versions, the initial attack vector is through malspam campaigns in which phishing emails contain a zipped attachment with malicious javascript that downloads the Locky payload.
Once the Locky payload is dowloaded, it encrypts the users’ files with “.diablo6” and “.Lukitus”, respectively.
Then it changes the desktop background and provides the rescue pages “diablo6.htm” and
“lukitus.htm”, which are identical.
Following what’s been standard for years, the Locky ransomware instructs the user to install a Tor
Browser, then navigate to your unique .onion address to pay the ransom.


Indicators of Compromise:
(Block the below malicious domains/IPs at the perimeter)
 greatesthits[dot]mygoldmusic[dot]com
 files with extension “ [.]lukitus” or “[.]diablo6”
 file Win[.]JSFontlib09[.]js
 hxxp://geocean.co[.]id/657erikftgvb??pGDIWEKDHD=pGDIWEKDHD
 Locky ransomware post-infection URL: hxxp://46.183.165.45/imageload.cgi
Fake dropbox sites:
 hxxp://albion-cx22.co[.]uk/dropbox.html
 hxxp://ambrogiauto[.]com/dropbox.html
 hxxp://arthurdenniswilliams[.]com/dropbox.html
 hxxp://autoecoleathena[.]com/dropbox.html
 hxxp://autoecoleboisdesroches[.]com/dropbox.html
 hxxp://autoecoledufrene[.]com/dropbox.html
 hxxp://avtokhim[.]ru/dropbox.html
 hxxp://bayimpex[.]be/dropbox.html
 hxxp://binarycousins[.]com/dropbox.html
 hxxp://charleskeener[.]com/dropbox.html
 hxxp://campusvoltaire[.]com/dropbox.html
 hxxp://dar-alataa[.]com/dropbox.html
 hxxp://flooringforyou.co[.]uk/dropbox.html
 hxxp://gestionale-orbit[.]it/dropbox.html
 hxxp://griffithphoto[.]com/dropbox.html
 hxxp://jakuboweb[.]com/dropbox.html
 hxxp://jaysonmorrison[.]com/dropbox.html
 hxxp://patrickreeves[.]com/dropbox.html
 hxxp://potamitis[.]gr/dropbox.html
 hxxp://tasgetiren[.]com/dropbox.html
 hxxp://willemshoeck[.]nl/dropbox.html



Actions/Recommendations/Countermeasures:

Users and administrators are advised to take the following preventive measures to
protect their computer networks from ransomware infection/ attacks:
 Perform regular backups of all critical information to limit the impact of data or
system loss and to help expedite the recovery process. Ideally, this data should
be kept on a separate device, and backups should be stored offline.
 Keep the operating system third party applications (MS office, browsers, browser
Plugins) up-to-date with the latest patches.
 Maintain updated Antivirus software on all systems
 Don't open attachments in unsolicited e-mails, even if they come from people in
your contact list, and never click on a URL contained in an unsolicited e-mail,
even if the link seems benign. In cases of genuine URLs close out the e-mail and
go to the organization's website directly through browser
 Follow safe practices when browsing the web. Ensure the web browsers are
secured enough with appropriate content controls.
 Establish a Sender Policy Framework (SPF) for your domain, which is an email
validation system designed to prevent spam by detecting email spoofing by
which most of the ransomware samples successfully reaches the corporate email
boxes.
 Check regularly for the integrity of the information stored in the databases.
 Regularly check the contents of backup files of databases for any unauthorized
encrypted contents of data records or external elements, (backdoors /malicious
scripts.)
 Ensure integrity of the codes /scripts being used in database, authentication and
sensitive systems
 Application white listing/Strict implementation of Software Restriction Policies
(SRP)to block binaries running from %APPDATA% and %TEMP% paths.
Ransomware sample drops and executes generally from these locations.
 Network segmentation and segregation into security zones - help protect
sensitive information and critical services. Separate administrative network from
business processes with physical controls and Virtual Local Area Networks.
 Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
 Disable remote Desktop Connections, employ least-privileged accounts. Limit
users who can log in using Remote Desktop, set an account lockout policy.
Ensure proper RDP logging and configuration.
 Restrict access using firewalls and allow only to selected remote endpoints, VPN
may also be used with dedicated pool for RDP access
 Use strong authentication protocol, such as Network Level Authentication (NLA)
in Windows.
 Additional Security measures that may be considered are
 Use RDP Gateways for better management
 Change the listening port for Remote Desktop
 Tunnel Remote Desktop connections through IPSec or SSH
 Two-factor authentication may also be considered for highly critical
systems


If not required consider disabling, PowerShell / windows script hosting.
Restrict users' abilities (permissions) to install and run unwanted software
applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level
anti-exploitation tools.
Block the attachments of file types,
exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and
information security audit of critical networks/systems, especially database servers
from CERT-IN empaneled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies
SIEM Monitoring:
Team added/updated all the malicious URL’s/Domains & IP address in monitoring.
References -
https://blog.appriver.com/2017/08/locky-ransomware-attacks-increase/
https://www.webroot.com/blog/2017/08/17/locky-ransomware-resurges-diablo-lukitus/
https://isc.sans.edu/forums/diary/Malspam+pushing+Locky+ransomware+tries+HoeflerText+notifications+for+Chrome+and+FireFox/22776/
http://www.zdnet.com/article/this-giant-ransomware-campaign-just-sent-millions-of-malware-spreading-emails/
https://www.forbes.com/sites/leemathews/2017/08/31/massive-ransomware-attack-unleashes-23-million-emails-in-24-hours/#30cc2155394b
https://www.databreachtoday.com/blogs/locky-ransomware-returns-two-new-variants-p-2528
https://twitter.com/peterkruse/status/903538736599891969

Comments

  1. The checkpoint is the important tool for the people who are in networking and should have known about this whole stuff, and I think this blog will help them a lot.

    ReplyDelete

Post a Comment

Popular posts from this blog

Download IOS Image for Router

tcpdumps in Checkpoint Firewall