The Cryptowall ransomware has enjoyed significant success in the emerging malware-as-a-service (MaaS) market, going through four revisions to up its encryption game and make it even harder for companies to recover user data. According to BetaNews, however, Cryptowall 4.0 is also getting a signal boost as part of the popular Angler exploit kit (EK).
Cryptowall 4.0 Follows the Money
As noted by SecurityWeek, the new Cryptowall comes with a number of improvements over old versions. It tricks users by masquerading as an antivirus solution checker when in fact it’s busy encrypting personal data. What’s more, version 4.0 encrypts file names along with the files themselves, making it impossible for users to target specific, high-value information as their first decrypt targets.
Prices are also going up. Cryptowall now wants $500 in bitcoin, and the ransom doubles in three days, making it difficult for typical users to effectively pay off the bad guys even if they were so inclined.
But the biggest worry? Cryptowall’s Angler addition. While the Nuclear EK team added 4.0 back in November 2015, security firm Bitdefender recently announced that Angler also opted in — which is especially problematic since Angler comes with obfuscation capabilities, antivirus detection, encrypted payloads and fileless infection.
With the kit compromising upward of 500,000 machines every month and the MaaS market quickly trending toward a corporate model that follows typical profit and competition rules, the addition makes good business sense: Cryptowall 4.0 is a value-added feature that nets Angler more downloads and a bigger piece of the MaaS market pie.
Coming Soon?
While ransomware is on the way up for 2016, it’s tempting to think of the problem as largely a user issue — enterprises have more to fear from data breaches than information encryption, right? According to a recent IT Web article, this may be a false sense of security. CEO of security firm ESET Carey van Vlaanderen noted that ransomware is quickly becoming an area of concern for IT professionals and CISOs.
Already, several European banks have been targeted by ransomware scams. While they’ve been largely unsuccessful owing to banks’ better-than-average IT security, it’s only a matter of time: Stolen sensitive information is one thing, but what if enterprises couldn’t conduct day-to-day operations because critical files were encrypted and then further obfuscated or hidden? It’s a safe bet C-suites would give serious consideration to a ransom payment.
Bottom line? The Angler inclusion of Cryptowall 4.0 shows savvy business acumen. Companies need to prepare for a world where enterprise-level MaaS targets big, small and everything in between.