Last week in security news, researchers spotted a flaw in an updated Ryuk ransomware decryptor used by attackers that could limit victims’ recovery efforts. Speaking of ransomware, analysts came across two other significant developments. First, they found that ransomware attackers are increasingly targeting organizations’ network-attached storage (NAS) devices as a means of encrypting their backup data. Second, they uncovered a new family of ransomware that boots an infected machine into safe mode so as to bypass endpoint protection.

Top Story of the Week: Ryuk’s Flawed Decryptor

According to Emsisoft, previous versions of Ryuk ransomware partially encrypted victims’ files that exceeded 54.4 MB in size. The decryptor provided by the attackers ultimately calculated the length of the footer, which appeared different for partially encrypted files, so that victims could successfully recover their files after paying the ransom.

A new variant of Ryuk made changes to the way that it calculated the footer of an encrypted file, however. These modifications caused the decryptor to cut off one too many bytes in the process of decryption. Such truncation permanently damaged some files and rendered them useless, thereby jeopardizing users’ ability to recover some of their larger files that had been encrypted.

Source: iStock

Also in Security News

• Snatch Ransomware Reboots Infected Machines In Safe Mode: Back in October, Sophos’ Managed Threat Response (MTR) team detected Snatch while remediating a ransomware infection for one of its customers. Its researchers found that Snatch had set itself up as a service that ran during a safe mode boot, thus allowing the ransomware to bypass security tools.
• NAS Devices Increasingly Targeted by Ransomware: Kaspersky Lab found in its IT threat evolution report for the third quarter of 2019 that ransomware had begun targeting NAS devices by scanning for these assets on the web and abusing known firmware vulnerabilities. If successful, the ransomware then encrypted all NAS-connected media, which most often included data backups.
• Consumers Urged to Exercise Caution Before Purchasing Smart Toys: The Federal Trade Commission (FTC) urged consumers to be careful when purchasing internet-connected smart toys for the holidays. It specifically urged consumers to seek to understand a smart toy’s features, what information the toy was programmed to store and how it would ultimately use that data.
• Malicious Office 365 App Stole Access to Victims’ Accounts in Phishing Campaign: PhishLabs detected a phishing campaign whose emails lured recipients into viewing what they thought was an internal SharePoint or OneDrive file share. If they complied, the campaign directed users to approve the permissions for a malicious app that effectively stole access to their Office account.
• XHelper Trojan Named Biggest Threat Affecting Mobile Users in November 2019: In its Global Threat Index for November 2019, Check Point Software revealed that the XHelper mobile Trojan had entered onto its top 10 malware list for the month at number eight. The security firm also disclosed that XHelper was the month’s biggest mobile threat, with Emotet still at the top of the malware list.
• Fake Payroll Emails Used by Phishers to Spread TrickBot Malware: Palo Alto Networks’ Unit 42 research team spotted a phishing campaign that used payroll- and annual bonus-themed emails to trick recipients into opening a Google Docs document. That file, in turn, contained malicious links to Google Drive that ultimately installed a TrickBot payload.
• HawkEye Keylogger Used as Loader for Cryptominer: Cofense spotted a phishing campaign whose emails used fake job applications as a theme to trick recipients into opening a .zip archive. That attachment downloaded a sample of the HawkEye keylogger; rather than stealing victims’ data, however, this sample of HawkEye simply loaded a sample of the CGMiner cryptominer.

Security Tip of the Week: Defending Against Ransomware

Security professionals can protect their organizations against increasingly sophisticated ransomware attacks by achieving full visibility into their network assets. They can then leverage that visibility to create a prioritization strategy for plugging known vendor vulnerabilities, thus better shielding their environment against common ransomware distribution vectors such as exploit kits.

Simultaneously, companies need to make sure that they have redundant backups of their data and that they test these backups regularly to confirm their recovery capabilities from ransomware attacks.