In some ways, the latest variation of Crysis (or Crisis, depending on whom you ask) malware either provides something for everyone, or it’s a nightmare scenario, depending on how you look at it. When Crysis first came to light, it was a fairly typical, if annoying, form of ransomware. It would encrypt some files and then demand ransom, ostensibly offering to decrypt those files if you paid.
Things have changed. Following a series of monthly updates, this malware is now able to exfiltrate critical files and user information, gain administrator rights to the computer it’s infecting and take over as an admin user. It also doesn’t matter if the computer is a PC or a Mac because Crysis can infect either platform, and once inside a network, it can also attack virtual machines and any server visible to the computer it’s on.
Complicating matters, the Crysis malware that’s out now doesn’t attack any OS vulnerabilities. According to a study by Symantec, the malware is inserted using a Java applet dropper. Normally, Java applets can’t access machine resources, but in this case, the attack includes sophisticated social engineering intended to get the machine’s user to allow it to have full access to the system.
Once installed on a machine, the Crysis malware can use a variety of self-running files to spread to other machines, including Windows Phone devices and other computers on the same network. Right now, the malware can only attack certain virtual machines (VMs) from VMware, but not other VMs, but there’s no reason this can’t be extended.
Adding to the misery, the Crysis malware also copies the admin login information for any computer it attacks to its command-and-control server, allowing that machine and others to be attacked as long as the credentials haven’t been changed. And if that’s not enough, the bad guys have now raised their ransoms from a few hundred bucks to levels well in excess of $20,000. And, of course, there’s no assurance that they will actually deliver the decryption keys or remove the malware.
Unfortunately, the malware developers aren’t resting. “What we see with most malware is that there is furious innovation,” said Stu Sjouwerman, CEO ofKnowbe4. “They’re using Agile development techniques with monthly releases.”
The rapid development is a result of competition, Sjouwerman said. “They’re adding new features at a very rapid clip because they’re fighting for criminal market share.”
While new versions of Crysis and other malware products are coming out rapidly, the creators of these packages are doing their best to hide the details, he said. “It is very hard to identify different versions; they’re trying to obfuscate those versions” to keep other criminals off balance, he said.
Read more on page 2…
Originally published on eWeek.
Page: 1 2
Fourth quarter results beat Wall Street expectations, as overall sales rise 6 percent, but EU…
Hate speech non-profit that defeated Elon Musk's lawsuit, warns X's Community Notes is failing to…
Good luck. Russia demands Google pay a fine worth more than the world's total GDP,…
Google Cloud signs up Spotify, Paramount Global as early customers of its first ARM-based cloud…
Facebook parent Meta warns of 'significant acceleration' in expenditures on AI infrastructure as revenue, profits…
Microsoft says Azure cloud revenues up 33 percent for September quarter as capital expenditures surge…