Brian Jackson - Fotolia
Cyber criminals use Microsoft PowerShell in ransomware attacks
A newly discovered family of ransomware, dubbed PowerWare, uses Microsoft PowerShell to target organisations through macro-enabled documents
Cyber criminals are launching attacks on healthcare firms and other enterprises with ransomware created using Microsoft’s PowerShell scripting language for system administration.
The ransomware was discovered by researchers at security firm Carbon Black when a healthcare organisation was targeted unsuccessfully through a phishing email campaign.
The newly discovered family of ransomware – dubbed PowerWare by the researchers – targets organisations through a macro-enabled Microsoft Word document, such as a fake invoice.
This approach of using PowerShell to retrieve and execute the malicious code means the ransomware can avoid writing new files to disk and blend in with legitimate activity, making it much more difficult to detect.
Traditional ransomware variants typically install malicious files on the system which, in some instances, can be easier to detect.
Although the code is simple, PowerWare is a novel approach to ransomware, the researchers said, reflecting a growing trend of malware authors thinking outside the box in delivering ransomware.
Carbon Black researchers found that PowerWare is delivered through a macro-enabled Microsoft Word document that launches two instances of PowerShell.
One instance downloads the ransomware script and the other takes the script as input to run the malicious code to encrypt files on the target system and demand payment for releasing them.
Read more about ransomware
- Businesses are still getting caught by ransomware, despite the fact that there are fairly straightforward methods to avoid it.
- Criminals use devices compromised for click fraud as the initial step in a chain of infections leading to ransomware attacks, warns security firm Damballa.
- The first half of 2014 saw an increase in online attacks that lock up user data and hold it to ransom.
- The Cryptolocker ransomware caught many enterprises off guard – but there is a defence strategy that works against it.
Retrieving encryption keys
In an interesting twist, PowerWare initially demands a $500 ransom, but this increases to $1,000 if the ransom is not paid after two weeks.
Ransomware is becoming increasingly popular with cyber criminals as a way of making money, increasing 26% in the last quarter of 2015 compared with the previous quarter, according to the McAfee Labs threat report published on 22 March 2016.
The Carbon Black researchers said organisations that have systems in place for full packet capture should be able to recover the encryption keys.
The researchers found that, when PowerWare calls its control and command servers, it does so over a plain-text protocol, making traffic easily observed.
Read more about cyber attack tools
- Criminal activity has become the top motivation for distributed denial-of-service attacksas the average attack becomes strong enough to down most businesses.
- Social engineering tops the list of popular hacking methods, underlining the need forcontinuous monitoring, according to security firm Balabit.
- UK firms are operating from a reactive security posture and tending to symptoms, rather than causes, and yet still believe they can detect threats faster than the industry average.
- Without using any exploits, hackers can turn synchronisation services such as Dropbox, GoogleDrive and Box into a devastating attack tool, warns Imperva.
Organisations simply have to identify the right domain and IP information from network traffic to retrieve the encryption key, the researchers said.
Carbon Black Enterprise Protection users can block the initial cmd.exe by Word that launches PowerShell with a rule that blocks cmd.exe from executing when launched by winword.exe.
They recommend covering other Microsoft Office applications – such as Excel and PowerPoint – in a similar way, as well as setting up a rule for browsers to block these apps from running PowerShell.
Disable macros in office documents
Security expert and SANS Institute instructor Ed Skoudis warned at RSA Conference 2016 in San Francisco that PowerShell has been fully weaponised in the past year.
According to Andrew Komarov, chief intelligence officer at security firm InfoArmor, PowerShell is used not just in ransomware, but in many malware samples related to cyber espionage.
“It provides very flexible functionality to work with a victim's operating system, and many bad actors use script-based scenarios due to the high level of possible obfuscation and polymorphism in order to bypass security controls on Windows based environments," he said
Brian Laing, vice-president of products at security firm Lastline, said very few users need the use of macros in their office documents.
“Users should always disable macros or, even better, not open files with macros unless they are 100% certain the file is not malicious. If they receive a file with macros and are unsure, they should contact their IT department to investigate the file. Home users should simply delete the file and move on,” he said.
Tim McElwee, president of managed security service provider Proficio said enterprises should step up their vigilance for phishing attacks, disable macros, and backup their systems.
“This can be accomplished internally or through a managed security services provider for industrial-strength security,” he said.
Read more on Hackers and cybercrime prevention
-
![]()
Cyber criminals pivot away from ransomware encryption
By: Alex Scroxton
-
![]()
Attack surface reduction rules for Microsoft productivity apps
By: Kyle Johnson
-
![]()
MS macro-blocking has forced cyber criminals to innovate
By: Alex Scroxton
-
![]()
Microsoft fixes two zero-days in final Patch Tuesday of 2022
By: Alex Scroxton
