Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Spotlight: Crypto Wall 4 - The Evolution Continues

Summary: Cisco Talos reports that CryptoWall 4 keeps encrypting victim files for ransom but changes its encryption algorithms, adds a technique to disable and delete all automatic Windows backup mechanisms, and uses undocumented API calls to read the host's local language settings. The malware downloads an RSA public key from its command and control server, encrypts files with a temporary AES key, terminates the infection if the local language is unsupported (including Russian, Kazakh, Ukrainian, Uzbek, Belarusian, Azeri, Armenian, Kyrgyz and Georgian), and injects code into svchost.exe to delete shadow copies without a UAC prompt.

Why it matters: With System Restore and shadow copies removed, a victim's only recovery path is an external backup or the private key, which Talos says exists only on the attacker side and is never sent to the victim's machine.

Read the original at Cisco Talos ↗

Topics
Malware
Related