October 24, 2017 By Shane Schick 2 min read

The cybercriminals behind the Locky ransomware attacks are upping their game by using an application linking feature in Windows to hit even more victims without being immediately noticed.

According to an advisory from the Internet Storm Center, the new variant of Locky ransomware exploits Microsoft’s Dynamic Data Exchange (DDE), a Windows feature that facilitates the electronic transfer of Office files using shared memory and data.

Locky Adopts DDE Hijacking Tactics

In keeping with similar approaches, the fraudsters created phony invoices laden with malicious links and distributed them via the Necurs spambot. Because they used DDE, the threat actors did not have to employ macros to download malware from a remote server.

The Locky malware self-destructs once the ransomware attacks are successful, at which point the cybercriminals demand payment in the form of bitcoin. Besides DDE, according to SecurityWeek, Locky is being disseminated via Visual Basic scripts and archived in formats such as RAR containing VBS, JSE and JS files. The variety of techniques makes the threat much more difficult for security experts to track.

DDE is hardly a new feature from Microsoft, dating back to the late 1980s. BankInfoSecurity pointed out that potential dangers associated with DDE include the ability for cybercriminals to instantly execute links in a document once a victim opens it.

Microsoft offered an alternative several years ago called Object Linking and Embedding (OLE) but continues to support DDE because it is a part of legacy versions of Office products. Though the company has been informed about the risks, it maintained that the issues with DDE do not technically represent a bug.

Predicting Locky Ransomware’s Next Move

Threatpost reported that the only way to avoid the issue entirely is to go into the settings of Office applications and ensure that they don’t automatically update links. Given that DDE is a legitimate feature, however, it is less likely to be stopped by traditional antivirus or security scanning systems.

Ransomware attacks from Locky will likely take many forms and target widely used applications such as Microsoft Word. Hijacking DDE may just be a taste of what’s yet to come.

More from

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments. During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today