Security researcher and SANS Internet Storm Center (ISC) handler Brad Duncan discovered a new ransomware variant. The malware, dubbed Sage 2.0, is a variant of CryLocker and requires victims to pay $2,000 in bitcoin to recover encrypted files, SecurityWeek reported.

Unzipping Sage Ransomware

The researcher found Sage 2.0 in a .zip file distributed by a spam campaign known to deliver Cerber payloads. In general, the emails contained blank subject lines and no text.

According to Duncan’s report, the malware appears as a .js file or Word document once a victim unzips the attachment. While most attachments observed contained Sage 2.0, some delivered Cerber malware instead, which may point to testing or load balancing efforts on the cybercriminals’ end.

The malware must remain persistent within the system to prevent resource access, so it stores a scheduled task as an executable in the user’s AppData/Roaming directory.

Traffic Jam

After infection, Duncan wrote, Sage 2.0 generates callback traffic in the form of HTTP POST requests. When the DNS fails to resolve some callback domains, the infected host sends user datagram protocol (UDP) packets to more than 7,000 IP addresses.

CryLocker also generates this kind of UDP-based peer-to-peer traffic, but Duncan noted that Sage 2.0’s output “appears to be somehow encoded or encrypted.” This difference in implementation justifies Duncan’s classification of Sage 2.0 as a CryLocker variant, since the two do basically the same thing post-infection.

Sage Advice

Duncan acknowledged the limitations of his observations. “I’m not sure how widely distributed Sage ransomware is,” he admitted, adding that he had only observed it in one spam campaign over a single day.

Given the hefty ransom it demands, it’s worth every user’s time to take steps to protect their systems from Sage ransomware. Blocking spam emails is a good start. In any case, just say no to unknown attachments.

More from

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…