Cybersecurity Snapshots #37 - New Ransomware Families and Variants
Cybersecurity Snapshots #37 -
New Ransomware Families and Variants
Researchers at Cybersecurity Ventures predict that ransomware will cost its victims around $265 billion annually by 2031, with a new attack on a consumer or business occurring every 2 seconds as ransomware perpetrators progressively refine their malware payloads and related extortion activities. Security researchers at Deloitte estimate that around 4,000 ransomware attacks occur daily. Researchers argue that companies cannot just put "good cybersecurity hygiene practices" into place to stay protected from ransomware attacks. Companies must also keep up to date on what new ransomware families or variants are being created so that they can make any changes to the security practices they have in place if they need to do so. In just the first half of 2022, the number of new ransomware variants that FortiGuard Labs identified increased by nearly 100% compared with the previous six-month period. The FortiGuard Labs team documented 10,666 new ransomware variants in the first half of 2022, compared with just 5,400 in the second half of 2021.
Security researchers at Fortinet have shared information on three new popular ransomware families: Aerst, ScareCrow, and Vohuk. The researchers noted that the new ransomware targets Windows computers, encrypts victim files, and demands a ransom payment in exchange for a decryption key. This new ransomware has been used in an increasing number of attacks. The researchers stated that Aerst was seen appending to encrypted files the ".aerst" extension and displaying a popup window containing the attacker's email address instead of dropping a typical ransom note. The researchers noted that the popup window contains a field where the victim can enter a purchase key required to restore the encrypted data. Aerst deletes Volume Shadow copies to prevent file recovery. The other ransomware Vohuk does drop a ransom note readme.txt, asking the victim to contact the attackers via email. Seemingly under continuous development, the malware assigns a unique ID to each victim. The researchers noted that this ransomware family appends the ".vohuk" extension to the encrypted files, replaces file icons with a red lock icon, and changes the desktop wallpaper with its own. This ransomware leaves a distinctive mutex, "Global\\VohukMutex," which prevents different instances of Vohuk ransomware from running on the same system. Vohuk has been used mainly to target users in Germany and India. The third ransomware, ScareCrow, has a ransom note named "readme.txt," which instructs victims to contact the attacker using one of three Telegram channels. This ransomware seems to be the most widespread, with files submitted from the United States, Germany, India, Italy, the Philippines, and Russia. The researchers noted that they have identified some similarities between ScareCrow and Conti, such as the use of the CHACHA algorithm for encryption and the use of the WMI command-line utility to delete Volume Shadow copies, which suggest that ScareCrow's developers might have used Conti source code leaked earlier this year. The researchers stated that the ransomware's developer has encrypted each command string in the malware, including DLL names, API names, and even command strings, with a different decryption routine. ScareCrow appends the ".crow" extension to the encrypted files.
According to the researchers at FortiGuard, the growth in the number of new ransomware families and variants is primarily because more adversaries are taking advantage of Ransomware-as-a-Service (RaaS) on the Dark Web. As new ransomware families come to life and as new variants are created, it will be critical for companies to stay informed as much as possible on what is happening and to make any changes needed to help mitigate them. .