Locky malware, currently one of the most active ransomware threats, has influenced a transition to new types of attachments used in malicious emails, Trend Micro researchers warn.
Ransomware often distributed via spam emails, especially now that the notorious Angler Exploit Kit (EK) is gone, and Locky appears responsible for a surge of certain delivery methods, researchers say. According to Trend Micro, 71% of known ransomware families arrive via email.
Email is a tried-and-tested method for malware delivery and is particularly effective when targeting enterprises and small and medium businesses (SMBs). Locky’s operators have been using this delivery method from the beginning, but they switched between various types of email attachments to ensure increased efficiency for their attacks.
Trend Micro security researchers explain that, on the one hand, this continuous switch between email attachments contributed to Locky’s prevalence, while on the other the increase in the use of certain file types in email attachments was influenced by this ransomware family alone.
“The first two months of the year, we spotted a spike in the use of .DOC files in spam emails. DRIDEX, an online banking threat notable for using macros, was, at one point, reported to be distributing Locky ransomware. From March to April, we saw a spike in the use of .RAR attachments, which is also attributed to Locky,” researchers say.
Most recently, Locky was seen using DLLs and .HTA file attachments for distribution, and researchers forecast that attackers will also adopt executable files such as .COM, .BIN, and .CPL for malware distribution purposes. Because many of these file types aren’t normally used to deliver malware, cybercriminals can more easily avoid detection.
“To block spam emails with JS, VBScript, WSF and HTA attachments, companies should use email solutions with different anti-spam filters such as heuristics and fingerprint technology. In addition, solutions with blacklisting mechanism can block known malicious sender IPs. To detect macro downloaders by Locky and Cerber, email solutions should have macro scanning feature that can detect any malicious macro components of threats,” Trend Micro researchers say.
The spam emails used to deliver ransomware usually contain common subject lines and employ social engineering to determine victims to execute the malicious files. Emails with subject lines that involve invoices, parcel delivery, confirmation of order, banking notifications, and payment receipts should be considered suspicious, the security researchers say.