Until recently, TeslaCrypt owned the lion’s share of the security community’s ransomware attention. However, the malware-makers have shut down their project and published a master decryption key.

While smart money was on the high-profile Locky to muscle in on TeslaCrypt territory, a low-profile offering known as Crysis ransomware is now stealing the show.

About the Front-Runner

According to SC Magazine, not only is Crysis filling the void left by TeslaCrypt, but this sneaky malware has taken the lead from Locky in number of infected devices.

It was first detected by ESET back in February 2016 and was relatively harmless. The original version didn’t use strong encryption, and with a bit of help, users could often retrieve their files without paying.

The newest iteration, however, has upped the ante with stronger algorithms that require substantial time and effort to break. Also of note: The Crysis ransomware encrypts almost every file it can find, including .exe, .dll and even files with no extension.

Fixed, network and removable drives are all fair game — the only things that don’t get encrypted are Windows system files and the malware’s own code. This broad-spectrum encryption both ratchets up user panic once infected and can also make computers unstable.

Crysis Ransomware Is Breaking In

When it comes to compromising devices, Crysis has two main vectors, Help Net Security reported: email attachments and “harmless-looking” installers. While spam email delivery isn’t anything new, the malware-makers are leveraging the old double file extension trick, which makes executables appear nonthreatening. They’re also distributing installers across shared networks that fake the name and nomenclature of popular apps.

Once compromised, computers display a splash screen that directs users to send three encrypted files to “technical support” via one of two provided email addresses. When the infection is verified, victims must pay between 400 and 900 euros — in bitcoin — for the safe return of their data.

It’s worth noting that the Crysis ransomware isn’t alone in using a mix of old and new techniques to slip through defenses and wreak havoc. For example, the Zcrypt strain leverages the autorun technique to propagate across attached devices, which was popular three years ago but fell out of fashion as security teams cracked down.

What’s old is new again. When combined with actual innovation such as all-file and strong encryption, it’s no wonder Crysis malware and similar strains are pushing the panic button for users and security pros alike. It’s further proof that ransomware writers aren’t stuck in the past or blinded by the future — cybercriminals use whatever works whenever possible to lock down files wherever they can.

More from

Increasingly Sophisticated Cyberattacks Target Healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

4 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Machine Learning Applications in the Cybersecurity Space

3 min read - Machine learning is one of the hottest areas in data science. This subset of artificial intelligence allows a system to learn from data and make accurate predictions, identify anomalies or make recommendations using different techniques. Machine learning techniques extract information from vast amounts of data and transform it into valuable business knowledge. While most industries use these techniques, they are especially prominent in the finance, marketing, healthcare, retail and cybersecurity sectors. Machine learning can also address new cyber threats. There…

3 min read

HHS Releases Hospital Cyber Resiliency Landscape Analysis

4 min read - On April 17, 2023, The U.S. Department of Health and Human Services (HHS) 405(d) Program announced the release of its Hospital Cyber Resiliency Initiative Landscape Analysis. This landmark analysis reports on domestic hospitals’ current state of cybersecurity preparedness. The scope of the HHS study was limited to activities that protect access to patient care and safety and reduce the negative impact of cyber threats on clinical operations. Breaches of sensitive data were considered only if the breach had a direct…

4 min read