Subject: FW: High Risk Threat Advisory - Locky Ransomware
From: Saurabh Dadu <[email-masked]>
To: manager <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Wed, 30 Mar 2016 13:47:26 +0000

From: ACPL - Securing Information Assets <infosec=[email-masked]<mailto:infosec=[email-masked]>> on behalf of ACPL - Securing Information Assets <[email-masked]<mailto:[email-masked]>>
Reply-To: ACPL - Securing Information Assets <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, 30 March 2016 at 6:56 PM
To: Saurabh Dadu <[email-masked]<mailto:[email-masked]>>
Subject: High Risk Threat Advisory - Locky Ransomware

Threat Advisory - Locky Ransomware

View this email in your browser<http://us3.campaign-archive2.com/?u=06e9e47efcd1d3971e54300e5&id=f8be2a0559&e=d9b0bf2e39>

[https://gallery.mailchimp.com/06e9e47efcd1d3971e54300e5/images/e3dcd83d-8dc8-4ce2-9931-2f99f9fb4c3f.jpg]

Locky Ransomware

“Locky” feels like quite a cheery-sounding name.

But it’s also the nickname of a new strain of ransomware, so-called because it renames all your important files so that they have the extension .locky.

Of course, it doesn’t just rename your files, it scrambles them first, and – as you probably know about ransomware – only the crooks have the decryption key.

You can buy the decryption key from the crooks via the so-called dark web.

The prices we’ve seen vary from BTC 0.5 to BTC 1.00 (BTC is short for “bitcoin,” where one bitcoin is currently worth about $400/£280).

[https://sophosnews.files.wordpress.com/2016/02/locky-ransom-1200.png?w=640&h=586]

The most common way that Locky arrives is as follows:

  *   You receive an email containing an attached document
  *   The document looks like gobbledegook.
  *   The document advises you to enable macros “if the data encoding is incorrect.”

[https://sophosnews.files.wordpress.com/2016/02/locky-macros-640.png?w=640&h=340]

  *   If you enable macros, you don’t actually correct the text encoding (that’s a subterfuge); instead, you run code inside the document that saves a file to disk and runs it.
  *   The saved file serves as a downloader, which fetches the final malware payload from the crooks.
  *   The final payload could be anything, but in this case is usually the Locky Ransomware.

Locky scrambles all files that match a long list of extensions, including videos, images, source code, and Office files like:
"wallet.dat, .key, .crt, .p12, .pem, .DOC, .odt, .ott, .sxw, .stw, .PPT, .XLS, .pdf, .RTF, .uot, .CSV, .txt, .xml, .3ds, .max, .3dm, .DOT, .docx,.docm, .dotx, .dotm, .602, .hwp, .ods, .ots, .sxc, .stc, .xlc, .xlm, .xlt, .xlw, .slk, .xlsb, .xlsm, .xltm, .xltx, .wk1, .wks, .123, .wb2, .odp, .otp, .sxi, .sti, .pps, .pot, .sxd, .std, .pptx, .potm, .potx, .uop, .odg, .otg, .sxm, .mml, .docb, .ppam, .ppsm, .sldx, .sldm, .ms11, .ms11(Security copy), .lay, .lay6, .asc, .SQLITE3, .SQLITEDB, .sql, .mdb, .db, .dbf, .odb, .frm, .MYD, .MYI, .ibd, .mdf, .ldf, .php, .c, .cpp, .pas, .asm, .h, .js, .vb, .vbs, .pl, .dip, .dch, .sch, .brd, .cs, .asp, rb, .java, .jar, .class, .pl, .sh, .bat, .cmd, .psd, .NET, .tiff, .tif, .jpg, .jpeg, .cgm, .raw, .gif, .png, .bmp, .svg, .djvu, .djv, .zip, .rar, .7z, .gz, .tgz, .tar, .bak, .tbk, .tar.bz2, .PAQ, .ARC, .aes, .gpg, .vmx, .vmdk, .vdi, .qcow2, .mp3, .wav, .swf, .fla, .wma, .mpg, .vob, .mpeg, .asf, .avi, .mov, .mp4, .3gp, .mkv, .3g2, , .flv, .wma, .mid, .m3u, .m4u n64, .011, .010, .099, .008, .007, .006, .005, .004, .003, .002, .001, .pst, .onetoc2, .ppsx, pptm, .xlsx, .dif, .csr"

Locky even scrambles wallet.dat, your Bitcoin wallet file, if you have one.

In other words, if you have more BTCs in your wallet than the cost of the ransom, and no backup, you are very likely to pay up. (And you’ll already know how to buy new bitcoins, and how to pay with them.)

Locky also removes any Volume Snapshot Service (VSS) files, also known as shadow copies, that you may have made.

Shadow copies are the Windows way of making live backup snapshots without having to stop working – you don’t need to logout or even close your applications first – so they are a quick and popular alternative to a proper backup procedure.

Once Locky is ready to hit you up for the ransom, it makes sure you see the following message by changing your desktop wallpaper:

[https://sophosnews.files.wordpress.com/2016/02/locky-wallpaper-640.png?w=640&h=376]

If you visit the dark web page given in the warning message, then you receive the instructions for payment that we showed above.

Unfortunately, there are no easy shortcuts to get your data back if you don’t have a recent backup.

Remember, also, that like most ransomware, Locky doesn’t just scramble your C: drive.

It scrambles any files in any directory on any mounted drive that it can access, including removable drives that are plugged in at the time, or network shares that are accessible, including servers and other people’s computers, whether they are running Windows, OS X or Linux.

If you are logged in as a domain administrator and you get hit by ransomware, you could do very widespread damage indeed.

Giving yourself up front all the login power you might ever need is very convenient, but please don’t do it.

Only login (or use Run As...) with admin powers when you really need them, and relinquish those powers as soon as you don’t.

WHAT YOU SHOULD DO TO SAFEGUARD YOURSELF?

  *   Backup regularly and keep a recent backup copy off-site. There are dozens of ways other than ransomware that files can suddenly vanish, such as fire, flood, theft, a dropped laptop or even an accidental delete. Encrypt your backup and you won’t have to worry about the backup device falling into the wrong hands.
  *   Don’t enable macros in document attachments received via email. Microsoft deliberately turned off auto-execution of macros by default many years ago as a security measure. A lot of malware infections rely on persuading you to turn macros back on, so don’t do it!
  *   Be cautious about unsolicited attachments. The crooks are relying on the dilemma that you shouldn’t open a document until you are sure it’s one you want, but you can’t tell if it’s one you want until you open it. If in doubt, leave it out.
  *   Don’t give yourself more login power than you need. Most importantly, don’t stay logged in as an administrator any longer than is strictly necessary, and avoid browsing, opening documents or other “regular work” activities while you have administrator rights.
  *   Consider installing the Microsoft Office viewers. These viewer applications<http://acpl.us3.list-manage.com/track/click?u=06e9e47efcd1d3971e54300e5&id=c344859d4a&e=d9b0bf2e39> let you see what documents look like without opening them in Word or Excel itself. In particular, the viewer software doesn’t support macros at all, so you can’t enable macros by mistake!
  *   Patch early, patch often. Malware that doesn’t come in via document macros often relies on security bugs in popular applications, including Office, your browser, Flash and more. The sooner you patch, the fewer open holes remain for the crooks to exploit.

In case you are struggling with Ransomware, pls write to us at [email-masked]<mailto:[email-masked]>
We will help you to strengthen your data and network security strategy to safeguard your most critical information assets.

Team ACPL
Securing Information Assets

Disclaimer:
This Advisory is for the education and convenience of our customers. We tred to ensure the accuracy, relevance, and timeliness of the information and events described; they are subject to change without notice.

This email was sent to [email-masked]<mailto:[email-masked]>
why did I get this?<http://acpl.us3.list-manage1.com/about?u=06e9e47efcd1d3971e54300e5&id=d0758f1ef8&e=d9b0bf2e39&c=f8be2a0559>    unsubscribe from this list<http://acpl.us3.list-manage.com/unsubscribe?u=06e9e47efcd1d3971e54300e5&id=d0758f1ef8&e=d9b0bf2e39&c=f8be2a0559>    update subscription preferences<http://acpl.us3.list-manage2.com/profile?u=06e9e47efcd1d3971e54300e5&id=d0758f1ef8&e=d9b0bf2e39>
ACPL Systems Pvt. Ltd. · #333-334, 3rd Floor, Tower-A, Spaze i-Tech Park, · Sector-49, Sohna Road, Gurgaon - 122002 · Gurgaon 122002 · India

[Email Marketing Powered by MailChimp]<http://www.mailchimp.com/monkey-rewards/?utm_source=freemium_newsletter&utm_medium=email&utm_campaign=monkey_rewards&aid=06e9e47efcd1d3971e54300e5&afl=1>