Spam Wave Spreads Ransomware Across Europe

Computer security researchers have warned of a massive wave of junk emails affecting accounts primarily in Europe, but also in North America and Asia, that distribute an attachment designed to install a ransomware variant known as Locky.

At the same time, the developers behind Locky have begun using increasingly sophisticated measures to evade security systems, researchers said.

Locky targets Europe

The spam campaign is the latest incident to indicate the growing danger posed by ransomware, which has seen its prevalence spike in recent months. Ransomware encrypts files on a computer or across a network of systems and requires a payment to decrypt the files.

The UK was amongst the countries the most targeted by the campaign, with the attachment in question making up 51 percent of all malware detected by computer security firm ESET over the past few days.

Luxembourg showed the highest concentration of the attachment, at 67 percent, followed by the Czech Republic at 60 percent and Austria at 57 percent, said ESET, which gave the malware the name JS/Danger.ScriptAttachment.

Significant rates of detection also appeared in the US and Canada, according to ESET.

The attachment is primarily used to install Locky, which is one of the more dangerous ransomware programs and has no known flaws allowing it to be removed without the intervention of its controllers.

“ESET considers ransomware one of the most dangerous cyberthreats at present, a fact that seems unlikely to change in the foreseeable future,” the company said in an advisory.

The JavaScript attachment arrives in a .zip file attached to an email, and if triggered the file attempts to download ransomware programs such as Locky, ESET said.

Security bypass

Attackers also experimented with additional ways of bypassing users’ security systems as the spam wave was beginning, according to computer security firm Proofpoint.

One of the attackers using Locky began using two obfuscation techniques to evade security scans at the beginning of last week and later in the week added a third technique, Proofpoint said.

“These efforts (are) much closer to full-fledged encryption than simple obfuscation,” the company said in an advisory. “These campaigns continue to demonstrate the trend of threat actors shifting delivery mechanisms and adding new layers of obfuscation and evasion to bypass security defenses.”

The firm recommended user vigilance and the use of multiple layers of security to help stop ransomware infections.

Public organisations affected

Amongst those hit by Locky during the latest campaign was a Mumbai government administrative centre that was affected as the the spam wave reached its peak late last week.

More than 150 computers were affected, but the infection was controlled before it could spread to more of the 5,300 computers running at the centre, according to reports in the local press. The centre, known as Mantralaya, carries out the administration of the state of Maharashtra in western India.

In February Locky affected a hospital in Hollywood, which paid more than £12,000 to unlock its systems, and in March the electronic systems of a hospital in Kentucky were limited by a Locky infection.

The FBI in March called for aid from businesses and IT experts in combating a ransomware variant called Samas that attempts to lock down entire networks and appeared to be targeting healthcare organisations.

Are you a security pro? Try our quiz!