Menu
New Locky ransomware version can operate in offline mode

New Locky ransomware version can operate in offline mode

The program will start encrypting files even if it can't connect to a command-and-control server

The creators of the widespread Locky ransomware have added a fallback mechanism in the latest version of their program for situations where the malware can't reach their command-and-control servers.

Security researchers from antivirus vendor Avira have found a new Locky variant that starts encrypting files even when it cannot request a unique encryption key from the attacker's servers because the computer is offline or a firewall blocks the communication.

Calling home to a server is important for ransomware programs that use public key cryptography. In fact, if they're unable to report back to a server after they infect a new computer, most such programs don't start encrypting files.

That's because the encryption routine relies on unique public-private key pairs that are generated by the attackers' servers for each computer.

First, the ransomware program generates a symmetric encryption key and uses an algorithm like AES (Advanced Encryption Standard) to encrypt files. Then, it reaches out to a command-and-control server and asks the server to generate an RSA key pair for the newly infected computer.

The public key is sent back to the ransomware program and is used to encrypt the AES encryption key. The private key, which is required to decrypt what the public key encrypted, never leaves the attackers' server and is the key that users get when they pay the ransom.

Because of this process, some ransomware infections can be rendered ineffective if a network firewall detects their connection attempt and blocks it as suspicious right from the start.

Companies can also quickly cut off a computer from the Internet if a ransomware detection is triggered to try to limit the damage. They can also take the whole network offline temporarily until they can investigate if other computers have also been affected.

These measures are no longer viable for Locky, one of the most widespread ransomware threats plaguing users today, because of the changes made to it.

The good news is that Locky will start encrypting files using a predefined public key that's the same for all offline victims. This means that if someone pays the ransom and obtains the private key, that key will work for all other offline victims as well.

Security researchers from F-Secure have observed two massive spam campaigns distributing Locky this week, one of them reaching 120,000 spam hits per hour, more than 200 times higher than the spam hits on a regular day, the researchers said in a blog post.

Both campaigns spread emails with rogue zip attachments that contained malicious JavaScript files. The use of JavaScript files to distribute malware has become an attacker favorite in recent months. Such files can be executed on Windows out of the box, without any special software.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments