On June 22, the Necurs botnets — millions spread out on different machines — all awoke from their slumber and began once again to terrorize victims who got in their path. Only exclamations of “It’s alive!” were missing from the news announcements about this reinvigoration.

Necurs Takes Some Time Off

The botnet slept for a few weeks, although researchers weren’t sure why. During that time period, according to Softpedia, there was a drop in the spam emails that contained Locky ransomware attachments. Dridex was also affected — researchers recorded a lower amount of generated spam emails with that banking Trojan attached — despite the fact that this threat typically uses its own botnet for campaigns.

MalwareTech had some thoughts about this resurgence. “The fact that bots will not stop polling the DGA until a C&C server replies with a digitally signed response would suggest that the botmasters are still fully in control of the botnet, or someone else has gotten a hold of the private key,” its blog stated. It seems that the botmasters are back after a brief vacation.

However, they didn’t pick up right where they left off — there are some new elements to the threat. The new campaign focuses on delivering downloaders for Locky via poisoned emails.

Locky had undergone a makeover too. Proofpoint noted that “just prior to the Necurs disruption, Locky authors had introduced new anti-sandboxing and evasion techniques. Those techniques are present in the new campaigns.”

Protecting From the Persistent Threat

The downloader used by Locky is written in JavaScript, so it’s simple to run. Proofpoint described the infection process, stating that if the malicious attachments were opened, they immediately download and install the ransomware via an obfuscated JavaScript document.

Make sure not to open any attachments from suspicious invoices, especially if they have suspicious file names. Necurs frequently leverages attachments with names containing random six-digit strings, Proofpoint noted. While you’re at it, set up your preferences so that any JavaScript files will not automatically run without your approval.

Whatever ransomware variant shows up at your doorstep one day, remember that clicking on something is giving it authority to exist inside your system. By taking care about what exactly gets to live in your cyber environment, you only help yourself.