More than 14 million ransomware emails were sent this week

More than 14 million emails carrying the Locky ransomware variant were sent out to unsuspecting, potential victims, Monday, according to research conducted by security firm AppRiver.

More than 14 million emails carrying the Locky ransomware variant were sent out to unsuspecting potential victims earlier this week, according to research conducted by security firm AppRiver.

The massive campaign likely relied on at least one botnet to send the barrage of emails, said analyst Jonathan French. Each email carried a malware-laden attachment causing a computer’s data to become encrypted when opened, holding the information ransom until payment is sent to the hacker.

Locky is a common, Windows-based ransomware variant that was first discovered in Feb. 2016. The typical ransom price to receive a decryption key for Locky is roughly .5 bitcoin, which is around $340 as of this article’s publication. 

AppRiver was able to monitor the flood of Locky emails on Oct. 24 by tracking activity on a global network of honeypot servers deployed by the company.

“Virus hits are tabulated on a global scale across our servers,” French explained, “we are able to pull the hit statistics for a rule we have and see the counts over time. If we know which specific rule is blocking which campaign — such as one we add for brand new malware variants — we are able to give a size to the amount of emails caught as well as a time frame.”

French believes the immense one-day Locky campaign was likely perpetrated by a single, coordinated group of actors.

“The initial guess is due to the sudden drop in traffic during the 3 p.m. time frame and then a subsequent jump in virus traffic again,” French said, “it seems unlikely two botnets would be that coordinated in sending malware. Looking closer at some of the sending IP addresses between the two, we can see that many of the IPs were active during both malware pushes.”

Prior to Monday’s campaign, the Locky ransomware variant had remained relatively dormant for several weeks, with few cases being reported or spotted in the wild, security researchers tell CyberScoop.

It remains unclear why the authors behind Locky apparently went underground for a brief period of time. It is possible that the botnets being used to distribute the malware may have required some sort of upgrade or maintenance, causing a lull in activity, said French.

Stopping the spread of ransomware, especially attacks aimed at American businesses, has become a major initiative for the FBI. Director James Comey, for example, has asked the private sphere to “trust” the Bureau and to consistently report ransomware attacks when they see them rather than to pay the ransoms quietly.

Consistent with FBI policy, a spokesperson said regarding this week’s flood of Locky ransomware: “we can neither confirm nor deny whether a matter is under investigation.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure