Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Crypto Bit: Another Ransomware Family Gets an Update

Summary: Unit 42 reported an updated CryptoBit ransomware variant distributed through Rig EK, with a campaign on June 23 and June 24, 2016 using a gate at realstatistics[.]info that checked screen resolution and timezone before returning JavaScript with an iframe to the exploit kit. The host was infected through an out-of-date Flash plugin, and from June 17 through June 27 researchers found at least 8 samples of the variant communicating to laoismacau[.]com on 58.64.142[.]89.

What you should know: The infection hinged on a single out-of-date Flash plugin, and the ransomware disguised its callback traffic with a fake user-agent and fake referrer so it looked like ordinary web browsing to defenders.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related