January 26, 2016 By Douglas Bonderud 2 min read

The Cryptowall ransomware has enjoyed significant success in the emerging malware-as-a-service (MaaS) market, going through four revisions to up its encryption game and make it even harder for companies to recover user data. According to BetaNews, however, Cryptowall 4.0 is also getting a signal boost as part of the popular Angler exploit kit (EK).

Cryptowall 4.0 Follows the Money

As noted by SecurityWeek, the new Cryptowall comes with a number of improvements over old versions. It tricks users by masquerading as an antivirus solution checker when in fact it’s busy encrypting personal data. What’s more, version 4.0 encrypts file names along with the files themselves, making it impossible for users to target specific, high-value information as their first decrypt targets.

Prices are also going up. Cryptowall now wants $500 in bitcoin, and the ransom doubles in three days, making it difficult for typical users to effectively pay off the bad guys even if they were so inclined.

But the biggest worry? Cryptowall’s Angler addition. While the Nuclear EK team added 4.0 back in November 2015, security firm Bitdefender recently announced that Angler also opted in — which is especially problematic since Angler comes with obfuscation capabilities, antivirus detection, encrypted payloads and fileless infection.

With the kit compromising upward of 500,000 machines every month and the MaaS market quickly trending toward a corporate model that follows typical profit and competition rules, the addition makes good business sense: Cryptowall 4.0 is a value-added feature that nets Angler more downloads and a bigger piece of the MaaS market pie.

Coming Soon?

While ransomware is on the way up for 2016, it’s tempting to think of the problem as largely a user issue — enterprises have more to fear from data breaches than information encryption, right? According to a recent IT Web article, this may be a false sense of security. CEO of security firm ESET Carey van Vlaanderen noted that ransomware is quickly becoming an area of concern for IT professionals and CISOs.

Already, several European banks have been targeted by ransomware scams. While they’ve been largely unsuccessful owing to banks’ better-than-average IT security, it’s only a matter of time: Stolen sensitive information is one thing, but what if enterprises couldn’t conduct day-to-day operations because critical files were encrypted and then further obfuscated or hidden? It’s a safe bet C-suites would give serious consideration to a ransom payment.

Bottom line? The Angler inclusion of Cryptowall 4.0 shows savvy business acumen. Companies need to prepare for a world where enterprise-level MaaS targets big, small and everything in between.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today