The program will start encrypting files even if it can't connect to a command-and-control server The creators of the widespread Locky ransomware have added a fallback mechanism in the latest version of their program for situations where the malware can’t reach their command-and-control servers. Security researchers from antivirus vendor Avira have found a new Locky variant that starts encrypting files even when it cannot request a unique encryption key from the attacker’s servers because the computer is offline or a firewall blocks the communication. Calling home to a server is important for ransomware programs that use public key cryptography. In fact, if they’re unable to report back to a server after they infect a new computer, most such programs don’t start encrypting files. That’s because the encryption routine relies on unique public-private key pairs that are generated by the attackers’ servers for each computer. First, the ransomware program generates a symmetric encryption key and uses an algorithm like AES (Advanced Encryption Standard) to encrypt files. Then, it reaches out to a command-and-control server and asks the server to generate an RSA key pair for the newly infected computer. The public key is sent back to the ransomware program and is used to encrypt the AES encryption key. The private key, which is required to decrypt what the public key encrypted, never leaves the attackers’ server and is the key that users get when they pay the ransom. Because of this process, some ransomware infections can be rendered ineffective if a network firewall detects their connection attempt and blocks it as suspicious right from the start. Companies can also quickly cut off a computer from the Internet if a ransomware detection is triggered to try to limit the damage. They can also take the whole network offline temporarily until they can investigate if other computers have also been affected. These measures are no longer viable for Locky, one of the most widespread ransomware threats plaguing users today, because of the changes made to it. The good news is that Locky will start encrypting files using a predefined public key that’s the same for all offline victims. This means that if someone pays the ransom and obtains the private key, that key will work for all other offline victims as well. Security researchers from F-Secure have observed two massive spam campaigns distributing Locky this week, one of them reaching 120,000 spam hits per hour, more than 200 times higher than the spam hits on a regular day, the researchers said in a blog post. Both campaigns spread emails with rogue zip attachments that contained malicious JavaScript files. The use of JavaScript files to distribute malware has become an attacker favorite in recent months. Such files can be executed on Windows out of the box, without any special software. Related content news Cisco adds AI features to AppDynamics On-Premises A new virtual appliance for Cisco's AppDynamics observability platform will give enterprise customers more deployment options as well as AI-driven capabilities for anomaly detection and root cause analysis, application security, and SAP monitori By Michael Cooney May 10, 2024 4 mins Network Management Software Network Monitoring news CHIPS Act to fund $285 million for semiconductor digital twins Plans call for building an institute to develop digital twins for semiconductor manufacturing and share resources among chip developers. By Andy Patrizio May 10, 2024 3 mins CPUs and Processors Data Center news Microsoft’s AI ambitions fuel $3.3 billion bet on Wisconsin data center The Mount Pleasant site was initially earmarked for a manufacturing plant operated by electronics giant Foxconn. By Sascha Brodsky May 10, 2024 6 mins Data Center news analysis Red Hat unveils image mode for its Linux distro New container image deployment method for Red Hat Enterprise Linux is aimed at helping enterprises streamline operations and management. By Maria Korolov May 09, 2024 5 mins Linux Networking PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe