Until recently, TeslaCrypt owned the lion’s share of the security community’s ransomware attention. However, the malware-makers have shut down their project and published a master decryption key.
While smart money was on the high-profile Locky to muscle in on TeslaCrypt territory, a low-profile offering known as Crysis ransomware is now stealing the show.
About the Front-Runner
According to SC Magazine, not only is Crysis filling the void left by TeslaCrypt, but this sneaky malware has taken the lead from Locky in number of infected devices.
It was first detected by ESET back in February 2016 and was relatively harmless. The original version didn’t use strong encryption, and with a bit of help, users could often retrieve their files without paying.
The newest iteration, however, has upped the ante with stronger algorithms that require substantial time and effort to break. Also of note: The Crysis ransomware encrypts almost every file it can find, including .exe, .dll and even files with no extension.
Fixed, network and removable drives are all fair game — the only things that don’t get encrypted are Windows system files and the malware’s own code. This broad-spectrum encryption both ratchets up user panic once infected and can also make computers unstable.
Crysis Ransomware Is Breaking In
When it comes to compromising devices, Crysis has two main vectors, Help Net Security reported: email attachments and “harmless-looking” installers. While spam email delivery isn’t anything new, the malware-makers are leveraging the old double file extension trick, which makes executables appear nonthreatening. They’re also distributing installers across shared networks that fake the name and nomenclature of popular apps.
Once compromised, computers display a splash screen that directs users to send three encrypted files to “technical support” via one of two provided email addresses. When the infection is verified, victims must pay between 400 and 900 euros — in bitcoin — for the safe return of their data.
It’s worth noting that the Crysis ransomware isn’t alone in using a mix of old and new techniques to slip through defenses and wreak havoc. For example, the Zcrypt strain leverages the autorun technique to propagate across attached devices, which was popular three years ago but fell out of fashion as security teams cracked down.
What’s old is new again. When combined with actual innovation such as all-file and strong encryption, it’s no wonder Crysis malware and similar strains are pushing the panic button for users and security pros alike. It’s further proof that ransomware writers aren’t stuck in the past or blinded by the future — cybercriminals use whatever works whenever possible to lock down files wherever they can.