Brian Jackson - Fotolia
This approach of using PowerShell to retrieve and execute the malicious code means the ransomware can avoid writing new files to disk and blend in with legitimate activity, making it much more difficult to detect.
Traditional ransomware variants typically install malicious files on the system which, in some instances, can be easier to detect.
Although the code is simple, PowerWare is a novel approach to ransomware, the researchers said, reflecting a growing trend of malware authors thinking outside the box in delivering ransomware.
Carbon Black researchers found that PowerWare is delivered through a macro-enabled Microsoft Word document that launches two instances of PowerShell.
One instance downloads the ransomware script and the other takes the script as input to run the malicious code to encrypt files on the target system and demand payment for releasing them.
Read more about ransomware
- Businesses are still getting caught by ransomware, despite the fact that there are fairly straightforward methods to avoid it.
- Criminals use devices compromised for click fraud as the initial step in a chain of infections leading to ransomware attacks, warns security firm Damballa.
- The first half of 2014 saw an increase in online attacks that lock up user data and hold it to ransom.
- The CryptoLocker ransomware caught many enterprises off guard – but there is a defence strategy that works against it.
Retrieving encryption keys
In an interesting twist, PowerWare initially demands a $500 ransom, but this increases to $1,000 if the ransom is not paid after two weeks.
Ransomware is becoming increasingly popular with cyber criminals as a way of making money, increasing 26% in the last quarter of 2015 compared with the previous quarter, according to the McAfee Labs threat report published on 22 March 2016.
The Carbon Black researchers said organisations that have systems in place for full packet capture should be able to recover the encryption keys.
The researchers found that, when PowerWare calls its control and command servers, it does so over a plain-text protocol, making traffic easily observed.
Read more about cyber attack tools
- Criminal activity has become the top motivation for distributed denial-of-service attacksas the average attack becomes strong enough to down most businesses.
- Social engineering tops the list of popular hacking methods, underlining the need forcontinuous monitoring, according to security firm Balabit.
- UK firms are operating from a reactive security posture and tending to symptoms, rather than causes, and yet still believe they can detect threats faster than the industry average.
- Without using any exploits, hackers can turn synchronisation services such as Dropbox, GoogleDrive and Box into a devastating attack tool, warns Imperva.
Organisations simply have to identify the right domain and IP information from network traffic to retrieve the encryption key, the researchers said.
Carbon Black Enterprise Protection users can block the initial cmd.exe by Word that launches PowerShell with a rule that blocks cmd.exe from executing when launched by winword.exe.
They recommend covering other Microsoft Office applications – such as Excel and PowerPoint – in a similar way, as well as setting up a rule for browsers to block these apps from running PowerShell.
Disable macros in office documents
According to Andrew Komarov, chief intelligence officer at security firm InfoArmor, PowerShell is used not just in ransomware, but in many malware samples related to cyber espionage.
“It provides very flexible functionality to work with a victim's operating system, and many bad actors use script-based scenarios due to the high level of possible obfuscation and polymorphism in order to bypass security controls on Windows based environments," he said
Brian Laing, vice-president of products at security firm Lastline, said very few users need the use of macros in their office documents.
“Users should always disable macros or, even better, not open files with macros unless they are 100% certain the file is not malicious. If they receive a file with macros and are unsure, they should contact their IT department to investigate the file. Home users should simply delete the file and move on,” he said.
Tim McElwee, president of managed security service provider Proficio said enterprises should step up their vigilance for phishing attacks, disable macros, and backup their systems.
“This can be accomplished internally or through a managed security services provider for industrial-strength security,” he said.