January 26, 2016 By Douglas Bonderud 2 min read

The Cryptowall ransomware has enjoyed significant success in the emerging malware-as-a-service (MaaS) market, going through four revisions to up its encryption game and make it even harder for companies to recover user data. According to BetaNews, however, Cryptowall 4.0 is also getting a signal boost as part of the popular Angler exploit kit (EK).

Cryptowall 4.0 Follows the Money

As noted by SecurityWeek, the new Cryptowall comes with a number of improvements over old versions. It tricks users by masquerading as an antivirus solution checker when in fact it’s busy encrypting personal data. What’s more, version 4.0 encrypts file names along with the files themselves, making it impossible for users to target specific, high-value information as their first decrypt targets.

Prices are also going up. Cryptowall now wants $500 in bitcoin, and the ransom doubles in three days, making it difficult for typical users to effectively pay off the bad guys even if they were so inclined.

But the biggest worry? Cryptowall’s Angler addition. While the Nuclear EK team added 4.0 back in November 2015, security firm Bitdefender recently announced that Angler also opted in — which is especially problematic since Angler comes with obfuscation capabilities, antivirus detection, encrypted payloads and fileless infection.

With the kit compromising upward of 500,000 machines every month and the MaaS market quickly trending toward a corporate model that follows typical profit and competition rules, the addition makes good business sense: Cryptowall 4.0 is a value-added feature that nets Angler more downloads and a bigger piece of the MaaS market pie.

Coming Soon?

While ransomware is on the way up for 2016, it’s tempting to think of the problem as largely a user issue — enterprises have more to fear from data breaches than information encryption, right? According to a recent IT Web article, this may be a false sense of security. CEO of security firm ESET Carey van Vlaanderen noted that ransomware is quickly becoming an area of concern for IT professionals and CISOs.

Already, several European banks have been targeted by ransomware scams. While they’ve been largely unsuccessful owing to banks’ better-than-average IT security, it’s only a matter of time: Stolen sensitive information is one thing, but what if enterprises couldn’t conduct day-to-day operations because critical files were encrypted and then further obfuscated or hidden? It’s a safe bet C-suites would give serious consideration to a ransom payment.

Bottom line? The Angler inclusion of Cryptowall 4.0 shows savvy business acumen. Companies need to prepare for a world where enterprise-level MaaS targets big, small and everything in between.

More from

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today