Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

New ‘Ranscam’ Ransomware Lowers The Bar But Raises The Stakes
DarkReading ^ | 7/11/2016 05:15 PM | Kelly Jackson Higgins

Posted on 07/14/2016 9:41:43 PM PDT by Utilizer

...

Ransomware variants are multiplying like rabbits: while some are more sophisticated and tougher to combat, others are more about scamming than kidnapping. Take the new Ranscam malware discovered by Cisco’s Talos team, a low-tech but highly destructive attack that demands ransom from its victims but never returns them their files because it actually deleted them.

Ranscam isn’t the first ransomware variant to destroy files rather than return them after victims pay up—there’s AnonPop and JIGSAW, for example—but it’s a glaring example of how the ransomware scam itself is so lucrative and easy to pull off that less sophisticated attackers are jumping in the game. It’s also a cautionary tale for victims counting on getting their files back when they hand over those Bitcoins.

The lack of crypto in the attack, despite promises of decryption if the victim pays up, also demonstrates that Ranscam is nowhere near as complex or advanced as Cryptowall and other ransomware attacks, the researchers say. It’s more like its name suggests: it’s a ransomware scam to make money quickly.

"Compared to other true ransomware variants such as Cryptowall which spend a significant amount of time and effort developing new functionality and features, Ranscam appears to indicate that smaller, less-funded threat actors are joining the game, attempting to quickly get a piece of the pie," says Earl Carter, security research engineer at Cisco Talos.

...

(Excerpt) Read more at darkreading.com ...


TOPICS: Business/Economy; Computers/Internet
KEYWORDS: computers; dataloss; internet; malware; ranscam; ransomware; security
Navigation: use the links below to view more comments.
first 1-2021 next last
Another headache to consider...
1 posted on 07/14/2016 9:41:43 PM PDT by Utilizer
[ Post Reply | Private Reply | View Replies]

To: Utilizer

Its time to execute people who launch these viruses. Literally.


2 posted on 07/14/2016 9:52:01 PM PDT by DesertRhino (Dogs are man's best friend, and moslems hate dogs. Add that up....)
[ Post Reply | Private Reply | To 1 | View Replies]

To: DesertRhino

Wife works from home. All her files were destroyed by cryptowall in April. It was and still is a nightmare for us. A lot of stress and countless hours, even though we had backups from a few months earlier and had 2 antivirus programs running. I agree, these crooks should be shot.


3 posted on 07/14/2016 10:10:19 PM PDT by Sleeping Freeper
[ Post Reply | Private Reply | To 2 | View Replies]

To: Sleeping Freeper
I have not been a victim of ransomeware, but I absolutely agree this should be a capital offense.
Extreme? perhaps; but how much damage to millions or even tens of thousands of people's lives justify eliminating the lives of animals that don't really matter?

We can rest assured that after the few first executions, the incidence of these mindless, useless criminals would quickly cease altogether.

4 posted on 07/14/2016 10:19:26 PM PDT by publius911 (IMPEACH HIM NOW evil, stupid, insane ignorant or just clueless, doesn't matter!)
[ Post Reply | Private Reply | To 3 | View Replies]

To: Utilizer

Malwarebytes.

A shame it’s necessary, but it seems to work.


5 posted on 07/14/2016 10:58:00 PM PDT by Jack Hammer
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sleeping Freeper
A lot of stress and countless hours, even though we had backups from a few months earlier and had 2 antivirus programs running.

Which antivirus programs missed Cryptowall?

6 posted on 07/14/2016 11:21:55 PM PDT by TChad
[ Post Reply | Private Reply | To 3 | View Replies]

To: Utilizer
These newer ones have a new delivery method now - Javascript attachments. Since most people have the default turned on in Explorer - not to show file extensions - they will name a file something like Invoice.txt.js. Since the .js extension doesn't show up, the file looks like Invoice.txt. Most people will assume that is safe to open ( Microsoft doesn't help matters, because the default icon for a javascript extension resembles a document icon ). People will click on this and it will execute the script, connecting to a download server, fetching the actual ransomware in the form of a Windows program (an .EXE file), and launching it to complete the infection.

The way to counter this is to create a text file with notepad and rename it with the js extension. Then right click on it and tell it to open this with Notepad from then on.This way if one accidentally downloads one of these and clicks on it, it won't execute.

Link to article about this :

Sophos Labs -Ransomware that’s 100% pure JavaScript, no download required

7 posted on 07/14/2016 11:25:16 PM PDT by TheCipher (Suppose you were an idiot and suppose you were a member of Congress. But I repeat myself. Mark Twain)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Utilizer

bkmk


8 posted on 07/15/2016 2:43:41 AM PDT by sauropod (Beware the fury of a patient man. I've lost my patience!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sleeping Freeper; DesertRhino
I agree, these crooks should be shot.

I was thinking extensive genital mutilation, without benefit of anesthesia, but I could accept shooting them.

9 posted on 07/15/2016 4:01:17 AM PDT by Hardastarboard
[ Post Reply | Private Reply | To 3 | View Replies]

To: DesertRhino

“Its time to execute people who launch these viruses. Literally.”

I’m with you.


10 posted on 07/15/2016 4:11:36 AM PDT by dljordan (WhoVoltaire: "To find out who rules over you, simply find out who you are not allowed to criticize.")
[ Post Reply | Private Reply | To 2 | View Replies]

To: Utilizer

All my web browsing activities are now done via my iPad, or a Pine64 running Linux. I no longer use my Windows based machines for web browsing activities. Streaming audio via Spotify or video via Netflix or Amazon Prime is ok via Windows.


11 posted on 07/15/2016 4:18:58 AM PDT by usconservative (When The Ballot Box No Longer Counts, The Ammunition Box Does. (What's In Your Ammo Box?))
[ Post Reply | Private Reply | To 1 | View Replies]

To: DesertRhino
Let's let our Special Forces units "train" by capturing them, and once captured, let's subject them to this for a week at whatever the biggest tech convention is at the time:

I drew this cartoon about a decade ago (I think) and I am no longer thinking of it as a "reasonable alternative" to the Death Penalty, but perhaps a precursor to it. Just a little payback first.

12 posted on 07/15/2016 4:39:19 AM PDT by rlmorel (Orwell described Liberals when he wrote of those who "repudiate morality while laying claim to it.")
[ Post Reply | Private Reply | To 2 | View Replies]

To: Hardastarboard

Find an old abandoned warehouse, preferably one with lots of rats!


13 posted on 07/15/2016 4:40:04 AM PDT by catman67 (14 gauge?)
[ Post Reply | Private Reply | To 9 | View Replies]

To: catman67
Or at least a Room 101 with a well-fitting rat mask for those hackers.

Liberals I am sure would point and say "Look! There is a conservative who is using 1984 as a manual!" at which I would have to respond "You project much?"

It is all fun and games for the Left ("Oh, hackers are just minor white-collar criminals, often just kids, we need to go easy on them and give them a second chance!") until one sees the massive amount of money and man-hours wasted, and the loss to individuals, and that wastage creeps into their ability to fund their comically useless entitlement programs and global-warming "remediations".

Not to mention their own bank accounts.

14 posted on 07/15/2016 5:18:23 AM PDT by rlmorel (Orwell described Liberals when he wrote of those who "repudiate morality while laying claim to it.")
[ Post Reply | Private Reply | To 13 | View Replies]

To: DesertRhino
Its time to execute people who launch these viruses. Literally.

Are these guys ever even caught? Aren't they usually Russians?

15 posted on 07/15/2016 7:35:02 AM PDT by Sans-Culotte ('''Political correctness is communist propaganda writ small''~ Theodore Dallrymple)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Jack Hammer

Linux. And frequent full backups.

Never been hit by a virus. Also never go online when forced to use the ‘doze OS, so it’s been a winning combo for decades now. :)


16 posted on 07/15/2016 8:03:05 AM PDT by Utilizer (Bacon A'kbar! - In world today are only peaceful people, and the muzrims trying to kill them)
[ Post Reply | Private Reply | To 5 | View Replies]

To: usconservative
...or video via Netflix or Amazon Prime is ok via Windows.

Well, dunno about you but when I try that then the bloody XP OS keeps insisting that it needs to receive its overdue Service Pack and keeps trying to "update" by connecting to u-soft.

Once I was called away for a few minutes and when I returned the machine was busily downgrading something at full speed and I was unable to stop it! I unplugged the machine and swore never again to allow XP access to the net, then spend quite a bit of time reinstalling all the partitions on the HDD to get the machine workable again.

Online vids or no, it's just not worth taking the chance of your machine being compromised.

17 posted on 07/15/2016 8:11:53 AM PDT by Utilizer (Bacon A'kbar! - In world today are only peaceful people, and the muzrims trying to kill them)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Sleeping Freeper

#3 I use Webroot and they say they can block ransomware.
I won’t know unless it happens to me.


18 posted on 07/15/2016 8:50:02 AM PDT by minnesota_bound
[ Post Reply | Private Reply | To 3 | View Replies]

To: minnesota_bound

#7 Thanks, I followed your instructions and created the notopad js file with your instruction in it and called it: ransomwareprotection.js


19 posted on 07/15/2016 9:54:36 AM PDT by minnesota_bound
[ Post Reply | Private Reply | To 18 | View Replies]

To: TChad

Norton and Mcafee. The problem is how it enters the computer. We suspect it came from one of her employers emails since she was pretty careful about opening attachments from people she didn’t know. She also used Skipe, but I don’t know how that would have affected it, but it was running in the background most of the time.

We talked to a local firm about trying to recover her files. It would be $400 to analyse, with no promise of fixing it. The ultimate cost could have run into the thousands. We checked out another firm and the fee was similar. We’re running WebRoot now, on a new computer. We’re also backing her files up at least a couple of times a week on external drives.


20 posted on 07/15/2016 7:03:20 PM PDT by Sleeping Freeper
[ Post Reply | Private Reply | To 6 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson