Security researchers say OphionLocker, a recently discovered strain of malicious software that takes over a user’s system until a payment is made, may be among the first to use one of the most advanced techniques for encrypting data files.
First reported by Trojan7Malware, this type of ransomware is believed to spread via online advertising campaigns that fool users into clicking on an area of a website that then takes over their computer. Those infected by OphionLocker need to fork over $300 in the virtual currency Bitcoin in order to get their system and data back.
Researchers at F-Secure Labs posted screenshots that showed how OphionLocker presents the ransom demand via a text file that informs victims that their photos, documents and other files have been encrypted and inaccessible to anyone but the cybercriminals. Website addresses within the text files are also difficult to detect because they are based on Tor, a protocol designed to protect the anonymity of those using it.
OphionLocker Ahead of the Curve
What makes this ransomware notable, however, is its use of elliptic curve cryptography (ECC). In an Ars Technica article, a former Apple engineer described ECC — which is not yet well understood, even by some in the IT industry — as the possible next generation of public key infrastructure. This suggests that those behind the attacks may be more experienced cybercriminals than those involved with other ransomware strains.
On the other hand, an article on Tom’s Guide suggested that OphionLocker shares some characteristics with threats such as CryptoWall and SynoLocker, which have emerged in the past year. This includes the use of the RIG exploit kit, a pack of software files that takes advantage of vulnerabilities in commonly used browsers such as Microsoft’s Internet Explorer. According to Kahu Security, the RIG exploit kit has been widely available in underground markets since this spring and is relatively inexpensive for cybercriminals at approximately $300 a week.
The Register pointed out that CTB Locker also used ECC, but this is less about bragging rights for the ransomware’s author and more about recognizing this as a particularly sophisticated form of attack. Ironically, the only ones safe from OphionLocker may be the security researchers themselves, who have discovered that it doesn’t really work if you’re studying malware threats in a virtual computing environment. For everyone else, the best prevention will probably sound familiar: Use antivirus software, be careful what you click on and hope for the best.