Menu
Australia specifically targeted by Cryptolocker: Symantec

Australia specifically targeted by Cryptolocker: Symantec

Security vendor finds the latest variant of the cryptomalware

Australian is increasingly being hit by cryptomalware, according to Symantec.

Symantec Pacific region technology senior director, Sean Kopelke, said malware such as Crytolocker continues to spread through email-based social engineering and affect Australian victims.

“When you look at Crytolocker, the most important thing from the hacker’s point of view is the success of getting people to open these up,” he said.

What Symantec found with previous versions of Cryptolocker is it needs to be focused on a particular region to succeed.

“They customise letters to make them looks as if they came from an Australian postal delivery company, energy supplier, or bank, so that’s why the crytomalware has become specific for Australia,” he said.

Fooling the gatekeeper

Kopelke has also seen clever tactics employed by cybercriminals to circumvent security to reach a user and get them to click on a link.

“When a malicious mail came through in the past, what a lot of security technologies would do is find the embedded URL and follow it through to the end,” he said.

“If it knows it is malicious, it will not allow that email to come through.”

However, hackers noticed their malware was being caught, so they started putting a capture form at the end that requiring the user to input text to make it go through.

The malicious servers would also be turned off at the other end, so when the security would scan the email and follow the link to the end, nothing malicious would be found at the end.

“The servers would be started in the morning, as that is when people would come to work, check their inbox and click the link in the email,” Kopelke said.

Same but different

Symantec’s research has found the Trojan.Cryptolocker.F family is the main type of cryptomalware affecting Australian victims.

With this variant, Kopelke said cybercriminals have changed the way they get through to systems.

“It is quite different to the old Cryptolocker, to the point where it is not the same as the original malware,” he said.

“The outcome is the same, where it encrypts data and demands a ransom, but the technologies and code is significantly different.”

Read more: Australian SMBs reliant on antivirus, unaware of APT: Trend Micro

Kopelke said even referring to it as a variant is a “stretch,” though admits cybercriminals have latched on to the word Crytolocker because the “brand recognition” from a hacker’s point of view is “quite strong.”

“If victims are caught by Cryptolocker and don’t have a good backup, attackers hope they will pay the ransom if they feel the likelihood of decrypting the data is low,” he said.

Because cybercriminals have tasted some success with crytpmalware in the Australian region, Kopelke expects them to continuing with this targeted focus.

Patrick Budmar covers consumer and enterprise technology breaking news for IDG Communications. Follow Patrick on Twitter at @patrick_budmar.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaresymantecCryptolockerdecryption

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments