Normally, computer users are grateful when their antivirus software blocks suspicious files, but an emerging strain of ransomware is keeping them out of their system entirely and steals information unless they pay up.

First revealed in a blog post from security firm Trend Micro, the ransomware, known as CrypVault, acts as though it is legitimate antivirus software, quarantining files such as documents, images and databases. Those files are then encrypted with an RSA-1024 public and private key pair generated via GnuPG. Deleted files are then overwritten using Microsoft’s SDelete. When victims try to open their files, they see a ransom note demanding payment.

A story on Help Net Security noted the ransom messages appear to be in Russian, which may mean CrypVault is not yet being aimed at potential victims in North America or Europe. However, it could be highly dangerous if it spreads since it can also steal passwords and send them back to cybercriminals using the Browser Password Dump tool. The ransomware is also noteworthy because of how difficult it is for users to recover their files, with an estimated 16 overwrite passes with SDelete.

As its name suggests, CrypVault renames all the files it encrypts with a .vault extension. This makes it look even more like a legitimate AV tool, The Stack noted. Additionally, the cybercriminals making the ransom demands hide their identities with the Tor browser. Of course, most computer users can avoid all this so long as they aren’t tricked into clicking on a malicious JavaScript file that’s being distributed as an email attachment.

Best defined as malware that seeks not only information but financial gain by its perpetrators, ransomware has been cropping up more often lately. Just a few weeks ago, security experts revealed a strain known as TelsaCrypt. According to TechSpot, the malware has been seeking out and locking files within more than 50 popular video game systems. It demands amounts ranging from $500 to $1,000 within a 72-hour period — otherwise, it vows to permanently destroy them.

Consumers and businesses will likely be unsure of how best to handle a ransomware such as CrypVault. According to an opinion piece on BankInfoSecurity, however, giving in to the ultimatums is not the answer, since there is usually no way to guarantee cybercriminals will keep their word. Plus, if the attack targets a business, there will still be questions and issues to work out that may affect customers, even if payments are made. Loss of reputation may end up costing far more than these kinds of cybercriminals ever receive.

More from

Increasingly Sophisticated Cyberattacks Target Healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

4 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Machine Learning Applications in the Cybersecurity Space

3 min read - Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information from vast amounts of data and transform it into valuable business knowledge. While most industries use these techniques, they are especially prominent in the finance, marketing, healthcare, retail and cybersecurity sectors. Machine learning can also address new cyber threats. There…

3 min read

HHS Releases Hospital Cyber Resiliency Landscape Analysis

4 min read - On April 17, 2023, The U.S. Department of Health and Human Services (HHS) 405(d) Program announced the release of its Hospital Cyber Resiliency Initiative Landscape Analysis. This landmark analysis reports on domestic hospitals’ current state of cybersecurity preparedness. The scope of the HHS study was limited to activities that protect access to patient care and safety and reduce the negative impact of cyber threats on clinical operations. Breaches of sensitive data were considered only if the breach had a direct…

4 min read