In some ways, the latest variation of Crysis (or Crisis, depending on whom you ask) malware either provides something for everyone, or it’s a nightmare scenario, depending on how you look at it. When Crysis first came to light, it was a fairly typical, if annoying, form of ransomware. It would encrypt some files and then demand ransom, ostensibly offering to decrypt those files if you paid.
Things have changed. Following a series of monthly updates, this malware is now able to exfiltrate critical files and user information, gain administrator rights to the computer it’s infecting and take over as an admin user. It also doesn’t matter if the computer is a PC or a Mac because Crysis can infect either platform, and once inside a network, it can also attack virtual machines and any server visible to the computer it’s on.
Complicating matters, the Crysis malware that’s out now doesn’t attack any OS vulnerabilities. According to a study by Symantec, the malware is inserted using a Java applet dropper. Normally, Java applets can’t access machine resources, but in this case, the attack includes sophisticated social engineering intended to get the machine’s user to allow it to have full access to the system.
Once installed on a machine, the Crysis malware can use a variety of self-running files to spread to other machines, including Windows Phone devices and other computers on the same network. Right now, the malware can only attack certain virtual machines (VMs) from VMware, but not other VMs, but there’s no reason this can’t be extended.
Adding to the misery, the Crysis malware also copies the admin login information for any computer it attacks to its command-and-control server, allowing that machine and others to be attacked as long as the credentials haven’t been changed. And if that’s not enough, the bad guys have now raised their ransoms from a few hundred bucks to levels well in excess of $20,000. And, of course, there’s no assurance that they will actually deliver the decryption keys or remove the malware.
Unfortunately, the malware developers aren’t resting. “What we see with most malware is that there is furious innovation,” said Stu Sjouwerman, CEO ofKnowbe4. “They’re using Agile development techniques with monthly releases.”
The rapid development is a result of competition, Sjouwerman said. “They’re adding new features at a very rapid clip because they’re fighting for criminal market share.”
While new versions of Crysis and other malware products are coming out rapidly, the creators of these packages are doing their best to hide the details, he said. “It is very hard to identify different versions; they’re trying to obfuscate those versions” to keep other criminals off balance, he said.
Read more on page 2…
Originally published on eWeek.
Page: 1 2
CMA receives 'provisional recommendation' from independent inquiry that Apple,Google mobile ecosystem needs investigation
Government minister flatly rejects Elon Musk's “unsurprising” allegation that Australian government seeks control of Internet…
Northvolt files for Chapter 11 bankruptcy protection in the United States, and CEO and co-founder…
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…