No one likes malware, but a particularly malicious type is called Ransomware, and it specifically preys on people’s data.
Ransomware essentially encrypts the entire user’s computer or specific files until a sum of money is paid to the attacker. While there is no guarantee the attacker will make the files or computer available again, it seems to be in their best interest to return access to the computer, otherwise no one else would pay once word got around.
A particularly nasty type of new ransomware has just been discovered, and it utilizes a surprising attack vector: virtual machines.
In a new report by Sophos, the operators of the Ragnar Locker are using another novel method to avoid being detected when encrypting files.
They are now deploying VirtualBox Windows XP virtual machines to execute the ransomware and encrypt files so that they are not detected by security software running on the host.
This attack is started by first creating a tool folder that includes VirtualBox, a mini Windows XP virtual disk called micro.vdi, and various executables and scripts to prep the system.
https://www.bleepingcomputer.com/news/security/ransomware-encrypts-from-virtual-machines-to-evade-antivirus
As the security software running on the victim’s host will not detect the ransomware executable or activity on the virtual machine, it will happily keep running without detecting that the victim’s files are now being encrypted.
Interestingly, Windows 10’s “Controlled Folder Access” may prevent this attack, as it prevents any unauthorized changes by applications without a password.
This is especially problematic for government organizations, business, and hospitals. In fact, one of their more recent attacks was on an energy company EDP (https://www.edp.com/en), where the attackers stole more than 10 TB of files and received a ransom of over 10 million dollars.
This attack illustrates how security software with behavioral monitoring is becoming more important to stem the tide of ransomware infections.
It’s more important than ever to implement safe browsing habits, and common sense when executing unknown files, as once the attacker is in your system, it’s game over.
It helps me if you share this post
Published 2020-05-23 17:27:04