Tracking New Ransomware Crypto Wall 2.0
Summary: CryptoWall 2.0, a new ransomware variant first spotted by F-Secure on October 1, encrypts document files with RSA and demands a $500 ransom payable only in 1.33 BitCoins, and unlike earlier versions it communicates with its command and control server over the Tor anonymization network. Unit 42's WildFire platform picked up 84 CryptoWall 2.0 variants since September 30 and over 85,000 separate delivery attempts since September 29, mostly through emails with executable attachments using fake invoice, fax and voicemail themes, with later campaigns adding exploit kits and a PDF exploiting CVE-2013-2729.
Why it matters: More than 85,000 delivery attempts in roughly three weeks, with new variants emerging daily, means the infection volume is high enough that backup coverage - the source's stated best defense - is the control that decides whether an incident becomes a payment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Privacy
- Mentions
- CVE-2013-2729CVE-2014-0556
- Related
- CVE-2013-2729: Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022Snowshoe Spam Attack Comes and Goes in a Flurry Cyber Risks ·Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026