As if banking malware Dridex weren’t enough, a new ransomware tool called Locky — and likely supplied by the same cybercriminals behind Dridex — has started making the rounds. Employing the same kind of macro-based infection vector as Dridex, this new threat has already been detected in more than 400,000 sessions, indicating that despite the cutesy name, its makers are determined to get the most from their malicious code.

Here’s a rundown of Locky’s ugly side.

Ransomware’s Macro Malady

According to Naked Security, this new strain of ransomware typically arrives as a Word document. If opened, the text looks like random garbage, but it comes with a helpful message: Enable macro if the data encoding is correct. Of course, turning on macros doesn’t fix the data (since it’s all nonsense anyway) but instead saves a file to the hard drive. The file is a downloader that fetches Locky from its command-and-control (C&C) server.

Once on board, the ransomware scrambles and then encrypts all files, tagging them all with a *.locky extension. What’s more, any external media drives attached to a desktop are also compromised. The malware also deletes any Volume Snapshot Service (VSS) files or shadow copies made by Windows in site backups.

Finally, a new wallpaper pops up that directs users on exactly how to reclaim their lost files — either through specific Web addresses or by using the Tor browser. Right now, decryption keys run between 0.5 and 1 bitcoin, or $200 to $400. So far, the ransomware has focused its efforts in the U.S., but it has also targeted firms in Canada and Australia.

Open Sesame!

So how can organizations stay safe from Locky? Regular off-site backups always help, along with the use of Microsoft Office viewers that let users see attached documents without actually opening them first. It’s also a good idea to limit login power and restrict the number of admin users on a system since the malware can only reach as far as user privileges allow. By enabling user account control (UAC) and keeping permissions to a minimum, it’s possible to limit the damage of a ransomware attack.

As noted by CSO Online, however, there may be another way to solve the problem of already-infected users: disrupting its key exchange. Unlike similar malware, which generates a random encryption key on the compromised computer and then sends this data back to base, Locky does it the other way by generating a key with its C&C infrastructure that is then sent to victim PCs. If infection is caught early enough, it may be possible to interrupt this process and prevent the encryption of critical files.

Bottom line? Locky is riding the macro-driven malware trend and can mean big disruptions for unsuspecting companies. Don’t let the name fool you — this one is out for blood.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…