Subscribe to our newsletters
Sign Up

The Hacker News — Cyber Security, Hacking, Technology News

Friday, October 30, 2015 Mohit Kumar

The Creators of the notorious CryptoWall ransomware virus have managed to raise more than $325 million (£212 million) in this past year alone.

Ransomware has emerged as one of the biggest cyber threats to web users in recent times.

Typically, hackers primarily gain access to a user's computer system using a ransomware malware, which encrypts all files with a strong cryptographic algorithm, and demand a ransom money to be paid in Bitcoin, typically between $200 and $10,000.

In June 2014, researchers first discovered the CryptoWall ransomware attack, and currently, the latest CryptoWall version 3.0 (CW3) is the most sophisticated and complex family of this malware backed by a very robust back-end infrastructure.


According to the latest report (pdf) published by Cyber Threat Alliance (CTA), an industry group formed last year to study emerging threats, researchers have discovered:
  • 406,887 CryptoWall infection attempts
  • Total of 4,046 malware samples
  • 839 command-and-control server URLs to send commands and receive data
  • 5 second-tier IP addresses
  • 49 different CryptoWall distribution campaigns
  • Out of 49, a single campaign, dubbed as "crypt100", infected as many as 15,000 computers worldwide
  • cybercriminals behind the ransomware are likely to a singular group due to several similarities
  • Same hacker group generated more than $18 Million in the past year alone from previous versions of CryptoWall.
According to the report, this single cybercriminal ring has generated as much as $325 million from the money paid by hundreds of thousands of CryptoWall 3.0 victims around the world to get their encrypted files unlocked.

Also Read: FBI Offers $3 Million Reward For Arrest Of Russian Hacker behind CryptoLocker Ransomware.
"When looking at the number of victims providing payment for the Cryptowall 3.0 ransomware, it becomes clear that this business model is extremely successful and continues to provide significant income for this group," report said.
The Ransomware lands on PCs the same way other malware does.
Cryptowall-ransomware-malware
CryptoWall 3.0 is being primarily distributed through exploit kits and phishing emails, with infected attachments or that contain links to malicious websites.


Currently, there is no option to crack or decrypt the files without the CryptoWall decryption key, so the only option is to accept the loss of files or pay the ransom money.

The best defense is to ensure that files are regularly backed up in such a way that it can't be reached by the attackers.

A few more things you can do to prevent your Computer from getting infected with ransomware, such as:
  • Use Antivirus software and Firewalls from reputable companies,
  • Avoid Opening Emails and attachments from unknown sources,
  • and always keep your operating system and software up-to-date.

Tuesday, October 27, 2015 Mohit Kumar

fbi-ransomware-malware
Your Headache is not my Problem.

If your computer gets hacked and infected with malware that holds your data for ransom, just pay off the criminals to see your valuable data again and do not expect the FBI to save them – it's what the FBI is advising concerning ransomware.

Ransomware is a sophisticated malicious software that lets hacker encrypts all the contents of a victim's hard drive or/and server and demands ransom (typically in Bitcoins) for the decrypt key.
Federal agencies and the FBI have long urged people not to pay ransom to the criminals, as there is no guarantee that they will even receive an unlock key.

The FBI – 'Better Pay up the Ransom'


However, while speaking at the 2015 Cyber Security Summit on Wednesday, Assistant Special Agent Joseph Bonavolonta, who oversees the FBI's Boston office, advised the companies infected with ransomware to better pay up the ransom, according to a recent report by Security Ledger.
"The ransomware is that good," said Bonavolonta. "To be honest, we often advise people just to pay the ransom."
So, is the FBI now sure that Paying Ransom would save the victim's data?

Malicious programs such as Cryptolocker, Cryptowall, and Reveton uses "ultra secure" encryption algorithms to encrypt victims' data, and the key to decrypt data can cost victims from $200 to $10,000.

However, even after paying this much of amount, there is no guarantee that victims will receive the key to recovering their data.

Even the police are not immune to Ransomware attacks. Cryptowall – currently the most widespread malware used – alone made criminal hackers over 18 Million in dollars from April 2014 to June 2015.

Due to the success of ransomware on such a vast scale, Bonavolonta said hackers are likely to keep their ransom demands low in an attempt to maximize profit. For this reason, they are mostly honest, he said, adding, "You do get your access back."
This advice from the FBI agent counters many public advisories on the ransomware. Also, not everyone would agree with what Bonavolonta advised because fulfilling demands of bad guys is equivalent to encouraging their bad practices.

Prevention is the Best Practice


As I previously recommended, the best defense measure against Ransomware is creating awareness within the organizations, as well as maintaining backups that are rotated regularly.

Most viruses are introduced by opening infected attachments or clicking on links to malware usually contained in spam emails. So, DO NOT CLICK on links provided in emails and attachments from unknown sources.

Also Read: Ransomware Attacks Threaten Wearable Devices and Internet of Things

Moreover, ensure that your systems are running the latest version of Antivirus software with up to date malware definitions.

Tuesday, April 14, 2015 Mohit Kumar

CoinVault-Ransomware-Decryptor
Are you one of those Windows users who have found themselves as victims of the CoinVault Ransomware?

If Yes, then we have a Good news for you:

Victims of CoinVault ransomware can now decrypt their files encrypted by malware using a free tool released by Kaspersky Lab.

With the Help of The National High Tech Crime Unit (NHTCU) of the Dutch Police, Security Researchers at Kaspersky Labs have developed 'CoinVault Ransomware Decryptor' that decrypts files locked by ransomware like CoinVault.

Ransomware malware is a growing cyber threat in which hackers primarily gain access to a user’s system and demand a ransom be paid.

Ransomware malware infects a computer or device to restrict the user’s access to the infected computer.

Typically, the ransomware malware will either 'lock' the computer to prevent normal usage or encrypt the files on it to prevent access.

Recently, during an investigation of the CoinVault ransomware, the Dutch police were able to obtain a 'Decryption keys' database from a command and control server of CoinVault.

The Ransomware Decryption tool released by Kaspersky Labs utilizes same decryption keys those were recovered by the Dutch police.

However, this Ransomware Decryption software will not work for all the victims because Police have just obtained a few thousand decryption keys from one command and control server of CoinVault.

Don't worry! Dutch police are actively searching for more CoinVault server and hope to find new ransomware decryption keys as soon as possible.
ransomware-removal-decrypt-tool
How to Decrypt files encrypted by CoinVault Ransomware?
Step 1: If you are infected with CoinVault, just note down the Bitcoin wallet address mentioned by the malware on the screen.
Step 2: Get the encrypted file list from ransomware interface.
Step 3: Download an effective antivirus and remove CoinVault Ransomware first.
Step 4: Open https://noransom.kaspersky.com and download the decryption tool released by Kaspersky Labs.
Step 5: Install additional libraries and Decrypt your files.

In order to protect your computer from malware:
  • Ensure your system software and antivirus definitions are up-to-date.
  • Avoid visiting suspicious websites.
  • Regularly backup your important files to a separate drive or storage that are only temporarily connected.
  • Be on high alert for pop-ups, spam, and unexpected email attachments.

Newsletter Subscription

Subscribe to our newsletter and get all latest hacking news, free eBooks delivered to your inbox.

Join Over 450,000 Subscribers!