These Two Unusual Versions Of Ransomware Tell Us A Lot About How Attacks Are Evolving

Two newly discovered forms of ransomware with very different traits show just how diverse the world of ransomware has become as more cyber criminals attempt to join in with cyber extortion.

Both forms of ransomware emerged in February and have been detailed by cybersecurity researchers at Trend Micro –AlumniLocker and Humble - with the two versions attempting to extort a bitcoin ransom in different ways.

AlumniLocker is a variant of Thanos ransomware and immediately stands out for demanding a payment of 10 Bitcoins from the infected victim – a figure currently equivalent to around $450,000.

The ransomware is delivered to victims via a malicious PDF attachment claiming to be an invoice which is distributed in phishing emails. The PDF contains a link which will extract a ZIP archive which runs a PowerShell script to drop the payload and execute the ransomware.

Like an increasing number of ransomware campaigns, the attackers behind AlumniLocker threaten to publish data stolen from the network of their victim if they're not paid within 48 hours – although given the ransom demand is so large, victims may decide it's too much to pay.

The ambitious ransom demand and other inconsistencies in their attack techniques – including how the data leak site doesn't actually work - could indicate that those behind AlumniLocker are probably just starting out.

"It does seem like this might be a new group that does not have experience in successfully ransoming their victims as the ransom demand is much higher than typical. Being that the leak site doesn't work is another example of showing their hand of being newbies. " Jon Clay, director of global threat communications at Trend Micro told ZDNet.

Humble ransomware also first appeared during February, but is very different in a number of ways. Firstly, the ransomware is much smaller, demanding just 0.0002 Bitcoins – currently just under $10 – for the return of files, indicating that Humble might be targeting individuals rather than organisations.

It's still unknown how exactly Humble is distributed, but researchers note that it's likely to be via phishing attacks.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)

In an effort to push victims towards paying the ransom, Humble threatens the victim by stating that if they restart their system, the Master Boot Record (MBR) will be rewritten, rendering the machine unusable. A second version of Humble carries the same threat, but instead says this will happen if the victim doesn't pay after five days.

Humble is unusual for ransomware in being compiled with an executable wrapper (Bat2Exe) in batch file. What's also strange is that it uses Discord – a voice, text and video communications service popular among gamers – to send reports back to its author.

Both forms of new ransomware are unusual, but both demonstrate that ransomware continues to be appealing to cyber criminals who see how the top gangs are making so much money, and want to do the same.

Organisations can help protect themselves from ransomware attacks with cybersecurity procedures including applying patches and using multi-factor authentication.

MORE ON CYBERSECURITY

• Ransomware as a service is the new big problem for business
• How to protect your organization's remote endpoints against ransomware TechRepublic
• Ransomware: How clicking on one email left a whole business in big trouble
• How to avoid a spear-phishing attack. 4 tips to keep you safe from timeless scams CNET
• Ransomware: Attacks could be about to get even more dangerous and disruptive