October 4, 2018 By Shane Schick 2 min read

Security researchers observed a new attack campaign in which the Viro botnet infects devices with ransomware and then uses those compromised machines to infect more victims.

Once downloaded, according to Trend Micro, Viro quickly generates encryption and decryption keys with a random number generator after scanning the infected device for the right registry. Interestingly, although the botnet is aimed primarily at Americans, the attack displays a ransom note in French after successfully encrypting files using RSA.

Viro first made headlines when it was discovered in the wild in late 2017.

Viro’s Expanded Spamming and Keylogging Capabilities

While early examples of ransomware simply held data hostage until victims paid up, the recent Viro attacks involve additional capabilities, such as penetrating users’ email systems and contact lists to spam other potential victims.

Its keylogging capabilities, meanwhile, allow cybercriminals to harvest other data, which was then sent back to a command-and-control (C&C) server to download additional malware or other files. The researchers speculated that Viro may be based on a variant of Locky, which made headlines throughout 2017.

On the plus side, the researchers noted that Viro’s C&C server had been taken down since they first observed the attacks — meaning it will no longer be able to encrypt files even if it lands on a victim’s machine.

How to Avoid Botnet-Borne Ransomware Attacks

Ransomware attacks like Viro often start when someone innocently clicks on an email attachment that triggers the download process. IBM experts advise security teams to restrict the execution of programs from temporary folders where malware files commonly reside. This is usually just a matter of leveraging common Software Restriction Policies (SRPs) and Group Policy Objects (GPOs) that are already available within security tools, which would block attempts by cybercriminals to copy malicious payloads from a temporary folder.

Threat actors may also aim ransomware at AppData or Local AppData folders. Organizations can keep ransomware at bay by turning off the ability to launch executables in these areas.

Source: Trend Micro

More from

Reducing ransomware recovery costs in education

4 min read - 2024 continued the trend of ransomware attacks in the education sector making headlines. The year opened with Freehold Township School District in New Jersey canceling classes due to a ransomware attack. Students at New Mexico Highlands University missed classes for several days while employees experienced disruption of their paychecks after a ransomware attack. The attack on the Alabama Department of Education served as a reminder that all school systems are vulnerable.Ransomware attacks in education decreasingThe year closes with some positive news…

Will AI threaten the role of human creativity in cyber threat detection?

4 min read - Cybersecurity requires creativity and thinking outside the box. It’s why more organizations are looking at people with soft skills and coming from outside the tech industry to address the cyber skills gap. As the threat landscape becomes more complex and nation-state actors launch innovative cyberattacks against critical infrastructure, there is a need for cybersecurity professionals who can anticipate these attacks and develop creative preventive solutions.Of course, a lot of cybersecurity work is mundane and repetitive — monitoring logs, sniffing out…

Hacking the mind: Why psychology matters to cybersecurity

4 min read - In cybersecurity, too often, the emphasis is placed on advanced technology meant to shield digital infrastructure from external threats. Yet, an equally crucial — and underestimated — factor lies at the heart of all digital interactions: the human mind. Behind every breach is a calculated manipulation, and behind every defense, a strategic response. The psychology of cyber crime, the resilience of security professionals and the behaviors of everyday users combine to form the human element of cybersecurity. Arguably, it's the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today