The group behind the CryptoMix malware have changed tactics once again. The bad actors in this case brute force a login through RDP, and then encrypt the data on your computer while attempting to identify and remove any local backups available. With a successful attack, there’s no way to regain your data without the decryption key or through an off-network backup of the system. When attempting to contact the group of enterprising individuals, they will send you an email claiming that the proceeds of your “donation” are going to be put towards charity. They allude that by paying the ransom, the victim will help fund the treatment and care of sick children! In addition to this patently absurd falsity, the bad actors have taken information from local news and crowdfunding websites to be more believable. While this is a bit far fetched, the idea behind it is rather applicable to malware.
The most vulnerable part of every secure system is the human element. Which brings attention to one of the most widely adopted tactics that has been used to acquire information in recent years: social engineering. By interacting with the human component and appealing to either emotions or inattentiveness, bad actors can obtain information or access to locations with next to zero technical prowess. A study at the university of Luxembourg showed that among three groups of individuals given a gift either at the start of interaction, after the question, or as a reward for revealing their password, anywhere from 3050% disclosed their sensitive information. The number goes as high as 47.9% when the reward is predicated on giving an answer. While this is just a single anecdote involving college students, the mentality doesn’t disappear when applied to the working world. Even clicking a real website link is enough when there exists a piece of malware that utilizes a flash exploit to infect the computer upon displaying the malicious advertisement.
One of the best solutions for this social vector is due diligence. Well-designed policies that employees are intimately aware of through thorough training, including awareness of these threats, better threat identification in e-mail firewalls, and clearer communication of proper procedures for employees will help ease the threat of this specific branch of malware. The science does not lie, people want to trust other people, especially those who are friendly, and identifying those who would abuse this trust for personal gain is easier said than done. As professionals, the education and increased awareness of those who aren’t so technically inclined is paramount for the safety of the collective companies that we represent.
Sources:
• https://www.sciencedaily.com/releases/2016/05/160512085123.htm
• https://www.zdnet.com/article/this-old-ransomware-is-using-anunpleasant-new-trick-to-try-and-make-you-pay-up/
• https://www.zdnet.com/article/this-malvertising-campaign-infected-pcswith-ransomware-without-users-even-clicking-a-link/