Locky Ransomware invasion through massive spam campaign- warns Cyber Swachhta Kendra, GOI

As per the fresh alert issued by Cyber Swachhta Kendra, GOI, it has been reported that a new wave of spam mails are circulating with common subject lines to spread variants of Locky ransomware. Reports indicate that over 23 million messages have been sent in this campaign. The messages contain common subjects like “please print”, “documents”, “photo”, “Images”, “scans” and “pictures”. However the subject texts may change in targeted spear phishing campaigns.

Locky Ransomware spreading through massive spam campaign

Ransomware Alert
Original Issue Date:- September 02, 2017
Virus Type:- Ransomware
Severity:- High

The messages contain “zip” attachements with Visual Basic Scripts (VBS) embedded in a secondary zip file. The VBS file contains a downloader which polls to domain “greatesthits[dot]mygoldmusic[dot]com” (please do not visit this malicious website) to download variants of Locky ransomware.

For details regarding Locky ransomware, please refer to alert regarding Locky ransomware issued in February 2016 here:

http://www.cyberswachhtakendra.gov.in/alerts/locky_ransomware.html

If the system is infected by Locky all files are encrypted and string with random numbers with extension “ [.]lukitus” or “[.]diablo6” is appended to the encrypted files. It may be noted that earlier variants of Locky add extension “.locky” to the encrypted files. After encryption, desktop background is changed with instructions and a “htm” file with a name “Lukitus[dot]htm”. The instructions contain installation of TOR browser and visiting “.onion” sites and demanding ransom of “.5 Bitcoins”

It is also reported that a spam campaign showing links to fake dropbox sites is being used to spread Locky variants.

If the pages are viewed in Chrome or Firefox, they show a fake notification stating “you don’t have the HoeflerText font”. These fake notifications had an “update” button that returns a malicious JavaScript (.js) file.

Users are advised to exercise caution while opening emails and organizations are advised to deploy anti spam solutions and update spam block lists.

Indicators of Compromise:

(Block the below malicious domains/IPs at the perimeter)

    • greatesthits[dot]mygoldmusic[dot]com
    • files with extension “ [.]lukitus” or “[.]diablo6”
    • file Win[.]JSFontlib09[.]js
    • hxxp://geocean.co[.]id/657erikftgvb??pGDIWEKDHD=pGDIWEKDHD
    • Locky ransomware post-infection URL: hxxp://46.183.165.45/imageload.cgi

Fake dropbox sites:

  • hxxp://albion-cx22.co[.]uk/dropbox.html
  • hxxp://ambrogiauto[.]com/dropbox.html
  • hxxp://arthurdenniswilliams[.]com/dropbox.html
  • hxxp://autoecoleathena[.]com/dropbox.html
  • hxxp://autoecoleboisdesroches[.]com/dropbox.html
  • hxxp://autoecoledufrene[.]com/dropbox.html
  • hxxp://avtokhim[.]ru/dropbox.html
  • hxxp://bayimpex[.]be/dropbox.html
  • hxxp://binarycousins[.]com/dropbox.html
  • hxxp://charleskeener[.]com/dropbox.html
  • hxxp://campusvoltaire[.]com/dropbox.html
  • hxxp://dar-alataa[.]com/dropbox.html
  • hxxp://flooringforyou.co[.]uk/dropbox.html
  • hxxp://gestionale-orbit[.]it/dropbox.html
  • hxxp://griffithphoto[.]com/dropbox.html
  • hxxp://jakuboweb[.]com/dropbox.html
  • hxxp://jaysonmorrison[.]com/dropbox.html
  • hxxp://patrickreeves[.]com/dropbox.html
  • hxxp://potamitis[.]gr/dropbox.html
  • hxxp://tasgetiren[.]com/dropbox.html
  • hxxp://willemshoeck[.]nl/dropbox.html

Note: For update on latest Indicators of Compromises, please see references to security vendors given in references section

Countermeasures, Precautionary and Preventive Actions:

Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:

  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
  • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
  • Maintain updated Antivirus software on all systems
  • Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser
  • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
  • Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
  • Check regularly for the integrity of the information stored in the databases.
  • Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
  • Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
  • Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
  • Network segmentation and segregation into security zones – help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
  • Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
  • Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
  • Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
  • Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
  • Additional Security measures that may be considered are
    • Use RDP Gateways for better management
    • Change the listening port for Remote Desktop
    • Tunnel Remote Desktop connections through IPSec or SSH
    • Two-factor authentication may also be considered for highly critical systems
  • If not required consider disabling, PowerShell / windows script hosting.
  • Restrict users’ abilities (permissions) to install and run unwanted software applications.
  • Enable personal firewalls on workstations.
  • Implement strict External Device (USB drive) usage policy.
  • Employ data-at-rest and data-in-transit encryption.
  • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
  • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
  • Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
  • Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

About Cyber Swachhta Kendra

The “ Cyber Swachhta Kendra ” (Botnet Cleaning and Malware Analysis Centre) is a part of the Government of India’s Digital India initiative under the Ministry of Electronics and Information Technology (MeitY) to create a secure cyber space by detecting botnet infections in India and to notify, enable cleaning and securing systems of end users so as to prevent further infections. The “ Cyber Swachhta Kendra ” (Botnet Cleaning and Malware Analysis Centre) is set up in accordance with the objectives of the “National Cyber Security Policy”, which envisages creating a secure cyber eco system in the country. This centre operates in close coordination and collaboration with Internet Service Providers and Product/Antivirus companies. This website provides information and tools to users to secure their systems/devices. This centre is being operated by the Indian Computer Emergency Response Team (CERT-In) under provisions of Section 70B of the Information Technology Act, 2000.

 

References

Russia celebrates the start of the school year and the Day of Knowledge, as Vladimir Putin delivers the national open lesson, focused on the Future

National open lesson Russia Focused on the Future As Russia celebrates the start of the school year and the Day of Knowledge, Vladimir Putin held the national open lesson Russia Focused on the Future. The event took place during a working trip to the Yaroslavl Region. More than 1 million schoolchildren around the country were […]

What is the time period within which invoice has to be issued in a case involving continuous supply of services under GST?

In case of continuous supply of services, (a) where the due date of payment is ascertainable from the contract, the invoice shall be issued before or after the payment is liable to be made by the recipient but within a period prescribed in this behalf whether or not any payment has been received by the […]

What is the time period within which invoice has to be issued in a case involving continuous supply of goods under GST?

In case of continuous supply of goods, where successive statements of accounts or successive payments are involved, the invoice shall be issued before or at the time each such statement is issued or, as the case may be, each such payment is received.

What is the time period within which invoice has to be issued for supply of Services under GST?

As per Section 28 of CGST/SGST Act a registered taxable person shall, before or after the provision of service, but within a period prescribed in this behalf, issue a tax invoice showing description, value of goods, tax payable thereon and other prescribed particulars.

What is the time period within which invoice has to be issued for supply of Goods under GST?

As per Section 28 of CGST/SGST Act a registered taxable person shall issue a tax invoice showing description, quantity and value of goods, tax charged thereon and other prescribed particulars, before or at the time of (a) removal of goods for supply to the recipient, where supply involves movement of goods or (b) delivery of […]

What is the time of supply, where supply is completed after to change in rate of tax?

In such cases time of supply will be (i) where the payment is received after the change in rate of tax but the invoice has been issued prior to the change in rate of tax, the time of supply shall be the date of receipt of payment; or (ii) where the invoice has been issued […]