New variants of Locky Ransomware are rising:
To proliferate ransomware, cyber criminals often employ spam emails (infectious attachments), unofficial software download sources, trojans, and fake software updates. eScan’s research team has found out that there are two new variants of Locky Ransomware which add .diablo6 or .lukitus as file extensions to the encrypted files.
Once infected it contacts its Command and Control (CnC) server and sends across the encryption keys which are important for successfully decrypting the files once the ransom has been paid. Unlike Wannacry Ransomware, there does not exist a Kill Switch Domain in Locky. WannaCry used the Eternal Blue exploit to propagate, it called back to a non-existent domain and this flaw was exploited by researchers to stop WannaCry dead in its track. However, with Locky this cannot be done.
Law Enforcement Agencies and Security Researchers may try to gain access to the CnC and provide the decryption keys as they have done this in the past. eScan PBAE detects and blocks these attempts by Locky Ransomware. (https://www.escanav.com/en/about-us/PBAE-technology.asp)
Locky File Extensions
Locky, after encrypting the files, changes the extension to one of the below mentioned:
- Administrators should block all executable files from being transmitted via emails.
- Administrators should isolate the affected system in the Network.
- Administrator can restore the encrypted files from the backup or from system restore point (if enabled) for affected systems.
- Install and Configure eScan with all security modules active.
eScan Real Time Monitoring
eScan Proactive protection
eScan Firewall IDS/IPS Intrusion prevention
- Users shouldn’t enable macros in documents.
- Organizations should deploy and maintain a backup solution.
- Most important, Organizations should implement MailScan at the Gateway Level for mail servers, to contain the spread of suspicious attachments.
Read more on Ranomware – Click Here