45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
Unit 42 observed Locky ransomware being delivered by the Nuclear exploit kit in March 2016 via Flash exploits, following February reports of Neutrino EK distributing Locky. Infections follow a drive-by chain through a gate to the Nuclear EK, which either installs Locky directly or drops a downloader that retrieves it from another domain. Locky retains two distribution paths: malspam with malicious Office macros or JavaScript attachments and exploit kit traffic triggered by casual web browsing.
24
CryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.
Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.
15
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45