June 24, 2016 By Larry Loeb 2 min read

On June 22, the Necurs botnets — millions spread out on different machines — all awoke from their slumber and began once again to terrorize victims who got in their path. Only exclamations of “It’s alive!” were missing from the news announcements about this reinvigoration.

Necurs Takes Some Time Off

The botnet slept for a few weeks, although researchers weren’t sure why. During that time period, according to Softpedia, there was a drop in the spam emails that contained Locky ransomware attachments. Dridex was also affected — researchers recorded a lower amount of generated spam emails with that banking Trojan attached — despite the fact that this threat typically uses its own botnet for campaigns.

MalwareTech had some thoughts about this resurgence. “The fact that bots will not stop polling the DGA until a C&C server replies with a digitally signed response would suggest that the botmasters are still fully in control of the botnet, or someone else has gotten a hold of the private key,” its blog stated. It seems that the botmasters are back after a brief vacation.

However, they didn’t pick up right where they left off — there are some new elements to the threat. The new campaign focuses on delivering downloaders for Locky via poisoned emails.

Locky had undergone a makeover too. Proofpoint noted that “just prior to the Necurs disruption, Locky authors had introduced new anti-sandboxing and evasion techniques. Those techniques are present in the new campaigns.”

Protecting From the Persistent Threat

The downloader used by Locky is written in JavaScript, so it’s simple to run. Proofpoint described the infection process, stating that if the malicious attachments were opened, they immediately download and install the ransomware via an obfuscated JavaScript document.

Make sure not to open any attachments from suspicious invoices, especially if they have suspicious file names. Necurs frequently leverages attachments with names containing random six-digit strings, Proofpoint noted. While you’re at it, set up your preferences so that any JavaScript files will not automatically run without your approval.

Whatever ransomware variant shows up at your doorstep one day, remember that clicking on something is giving it authority to exist inside your system. By taking care about what exactly gets to live in your cyber environment, you only help yourself.

More from

Poland spending $760 million on cybersecurity after attack

3 min read - Visitors to the Polish Press Agency (PAP) website on May 31 at 2 p.m. Polish time were met with an unusual message. Instead of the typical daily news, the state-run newspaper had supposedly published a story announcing that a partial mobilization, which means calling up specific people to serve in the armed forces, was ordered by Polish Prime Minister Donald Tusk beginning on July 1, 2024. Deputy Prime Minister Krzysztof Gawkowski refuted the claim on X (formerly Twitter). His post…

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today