Story image

What makes Locky and Cerber ransomware so good - and what about CradleCore?

10 May 17

Since its discovery last year, the Locky ransomware has become one of the most notable forms of malware on the scene, constantly updating itself but still managing to use the same general distribution methods. And it shows no sign of going away, according to Trend Micro.

The company posted a blog this month in which it compared Locky tactics to those of the equally formidable Cerber ransomware - and how they have both evolved.

Locky has been on and off the radar, but the latest variant uses a Microsoft Word document with macros enabled to deliver its load.  Spam email spread a PDF file attachment. This attachment contains the macro-enable file, which then runs when a victim opens the file.

Meanwhile the Cerber ransomware is proving to be a more prevalent and difficult malware to deal with. It has evolved several times and has managed to defeat many sandboxes and antiviruses, including machine learning tools.

The latest version of the ransomware is spread through spam emails disguised as a courier delivery service, Trend Micro says.

Malicious Javascript files hide in the attachment, with three main functions: download and execute Cerber, create a scheduled task that runs the ransomware after two minutes, and runs an embedded PowerShell Script.

Trend Micro says that the fact that Cerber is able to use stealth and launch after a two minute delay means that is can dodge traditional sandboxes. 

It is also able to use “Windows firewall rules that block the outbound traffic of all executable binaries of security products installed in the user’s computer, limiting both detection and mitigation capabilities  of these applications,” the Trend Micro blog states.

The company is also quick to point out that Ransomware-as-a-Service (RaaS) traditionally prevented users from accessing the source code, but a new kit called CradleCore is changing all of that. 

It is being sold as C++ source code that features anti-sandboxing and offline encryption. It demands around 0.25 Bitcoins as a ransom.

While Trend Micro says that little is known about the CradleCore ransomware, the company suspects that because it is still distributed by spam and phishing, it shows the power of those delivery methods. 

McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
IoT and real-time visibility: The future of intelligent enterprise
"Given the enormous potential of IoT, any companies that don’t act will risk falling behind."
O-RAN Alliance and Linux to create an open source software community
“Our joint efforts will help accelerate the creation, integration, and deployment of open source in RAN.”
MulteFire announces industrial IoT network specification
The specification aims to deliver robust wireless network capabilities for Industrial IoT and enterprises.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.
How Adobe aims to drive digital transformation for financial services
Digital transformation is a requirement for ongoing competitiveness that clearly helps businesses run more efficiently.