January 26, 2017 By Larry Loeb < 1 min read

Security researcher and SANS Internet Storm Center (ISC) handler Brad Duncan discovered a new ransomware variant. The malware, dubbed Sage 2.0, is a variant of CryLocker and requires victims to pay $2,000 in bitcoin to recover encrypted files, SecurityWeek reported.

Unzipping Sage Ransomware

The researcher found Sage 2.0 in a .zip file distributed by a spam campaign known to deliver Cerber payloads. In general, the emails contained blank subject lines and no text.

According to Duncan’s report, the malware appears as a .js file or Word document once a victim unzips the attachment. While most attachments observed contained Sage 2.0, some delivered Cerber malware instead, which may point to testing or load balancing efforts on the cybercriminals’ end.

The malware must remain persistent within the system to prevent resource access, so it stores a scheduled task as an executable in the user’s AppData/Roaming directory.

Traffic Jam

After infection, Duncan wrote, Sage 2.0 generates callback traffic in the form of HTTP POST requests. When the DNS fails to resolve some callback domains, the infected host sends user datagram protocol (UDP) packets to more than 7,000 IP addresses.

CryLocker also generates this kind of UDP-based peer-to-peer traffic, but Duncan noted that Sage 2.0’s output “appears to be somehow encoded or encrypted.” This difference in implementation justifies Duncan’s classification of Sage 2.0 as a CryLocker variant, since the two do basically the same thing post-infection.

Sage Advice

Duncan acknowledged the limitations of his observations. “I’m not sure how widely distributed Sage ransomware is,” he admitted, adding that he had only observed it in one spam campaign over a single day.

Given the hefty ransom it demands, it’s worth every user’s time to take steps to protect their systems from Sage ransomware. Blocking spam emails is a good start. In any case, just say no to unknown attachments.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today