The creators of the widespread Locky ransomware have added a fallback mechanism in the latest version of their program for situations where the malware can’t reach their command-and-control servers.
Security researchers from antivirus vendor Avira have found a new Locky variant that starts encrypting files even when it cannot request a unique encryption key from the attacker’s servers because the computer is offline or a firewall blocks the communication.
Calling home to a server is important for ransomware programs that use public key cryptography. In fact, if they’re unable to report back to a server after they infect a new computer, most such programs don’t start encrypting files.
That’s because the encryption routine relies on unique public-private key pairs that are generated by the attackers’ servers for each computer.
First, the ransomware program generates a symmetric encryption key and uses an algorithm like AES (Advanced Encryption Standard) to encrypt files. Then, it reaches out to a command-and-control server and asks the server to generate an RSA key pair for the newly infected computer.
The public key is sent back to the ransomware program and is used to encrypt the AES encryption key. The private key, which is required to decrypt what the public key encrypted, never leaves the attackers’ server and is the key that users get when they pay the ransom.
Because of this process, some ransomware infections can be rendered ineffective if a network firewall detects their connection attempt and blocks it as suspicious right from the start.
Companies can also quickly cut off a computer from the Internet if a ransomware detection is triggered to try to limit the damage. They can also take the whole network offline temporarily until they can investigate if other computers have also been affected.
These measures are no longer viable for Locky, one of the most widespread ransomware threats plaguing users today, because of the changes made to it.
The good news is that Locky will start encrypting files using a predefined public key that’s the same for all offline victims. This means that if someone pays the ransom and obtains the private key, that key will work for all other offline victims as well.
Security researchers from F-Secure have observed two massive spam campaigns distributing Locky this week, one of them reaching 120,000 spam hits per hour, more than 200 times higher than the spam hits on a regular day, the researchers said in a blog post.
Both campaigns spread emails with rogue zip attachments that contained malicious JavaScript files. The use of JavaScript files to distribute malware has become an attacker favorite in recent months. Such files can be executed on Windows out of the box, without any special software.