Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Locky Ransomware Installed Through Nuclear EK

Summary: Unit 42 reported that Locky ransomware, first analyzed in February 2016 and previously spread through malicious Office macros and zip attachments containing malicious JavaScript, was also being delivered through exploit kit traffic from casual web browsing. In March 2016 the researchers observed Locky delivered via Nuclear EK, with a gate at IP 91.195.12.177 and domain sed.poudelkamal.com.np, Nuclear EK at IP 46.101.8.169, and a follow-up payload that either was Locky or downloaded it from another domain.

Key Takeaway: The EK path drew little public reporting even as Locky spread widely through malspam, so an infection route that starts with nothing more than a user browsing the web can go unnoticed until hosts are already encrypted.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related