For a while now ransomware scare hadn’t made it to the headlines, but that ceased to be true with Symantec reporting of a Breaking Bad-themed ransomware on the prowl in Australia infecting and locking up computers with a demand for AU $450 and AU $1000 in case the users miss the initial deadline.
Dubbed Trojan.Cryptolocker.S, the ransomware encrypts a range of files including images, videos, documents, and more on the compromised computer – almost all important and personal data that a user might have stored on the infected computer – and demands up to AU$1,000 to decrypt these files.
The demand message uses the ‘Los Pollos Hermanos’ branding image as found in the Breaking Bad show and in the extortion message uses the famous words “I am the one who knocks” by Walter White as part of the email address.
“The malware encrypts files using a random Advanced Encryption Standard (AES) key,” explained Symantec. “This key is then encrypted with an RSA public key so that victims can only decrypt their files by obtaining the private key from the attackers.”
The malware uses the well-proven way of social engineering through email containing a malicious zip archive for infection. The archive contains a legitimate PDF file, but beyond that it also contains ‘PENALTY.VBS’ – a Trojan downloader – which executes and downloads the crypto ransomware onto the victim’s computer.
Researchers at the security company have revealed that their initial analysis shows that the malware uses components or similar techniques to an open-source penetration-testing project, which uses Microsoft PowerShell modules. This allows the attackers to run their own PowerShell script on the compromised computer to operate the crypto ransomware.
Once the ransomware has done its deeds, it shows up a ransom page demanding AU $450 as an initial payment, which shoots up to AU $1000 if the user doesn’t pay up on time. The payment has to be made in Bitcoins. For those who are unware about Bitcoin buying locations, the ransomware creators have posted a link to a video as well that explains how to obtain bitcoins.
How to stay protected against ransomware
- First and foremost is to make sure that you have a comprehensive security software installed on your computer.
- Second is to ensure that you apply all the security updates released by your operating system and software vendor as these updates will ensure that all known vulnerabilities that opens your computer for potential security breaches are patched.
- Ensure that you back up important contents on your computer so that they can be restored once the malware is removed from the computer.
- Last but not the least, stay alert and aware of the latest security threats that may affect you by reading up on news, security advisories as and when possible.
