Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Security Bitcoin IT Technology

New Ransomware 'Jaff' Spotted; Malware Groups Pushing 5M Emails Per Hour To Circulate It (theregister.co.uk) 58

An anonymous reader writes: The Necurs botnet has been harnessed to fling a new strain of ransomware dubbed "Jaff". Jaff spreads in a similar way to the infamous file-encrypting malware Locky and even uses the same payment site template, but is nonetheless a different monster. Attached to dangerous emails is an infectious PDF containing an embedded DOCM file with a malicious macro script. This script will then download and execute the Jaff ransomware. Locky -- like Jaff -- also used the Necurs botnet and a booby-trapped PDF, security firm Malwarebytes notes. "This is where the comparison ends, since the code base is different as well as the ransom itself," said Jerome Segura, a security researcher at Malwarebytes. "Jaff asks for an astounding 2 BTC, which is about $3,700 at the time of writing." Proofpoint reckons Jaff may be the work of the same cybercriminals behind Locky, Dridex and Bart (other nasty malware) but this remains unconfirmed. And Forcepoint Security Labs reports that malicious emails carrying Jaff are being cranked out at a rate of 5 million an hour on Thursday, or 13 million in total at the time it wrote up a blog post about the new threat.
This discussion has been archived. No new comments can be posted.

New Ransomware 'Jaff' Spotted; Malware Groups Pushing 5M Emails Per Hour To Circulate It

Comments Filter:
  • by Anonymous Coward on Friday May 12, 2017 @12:03PM (#54406477)

    Does anyone know what settings I need in WINE to make this work in Linux? Getting sick of all these Windows-specific programs!

  • by CAOgdin ( 984672 ) on Friday May 12, 2017 @12:15PM (#54406525)

    ...I have 100% backups of every computer on my LAN, every night, stored to an external drive, one of three that I rotate among. The backups are automatic, concluded by shutting down the computer from which the backup was just copies to disk, every night. I have about a weeks' worth of backups on each disk, for each computer on the LAN, so I have about three weeks' worth of backups on hand. Rolling back is easy, and takes less than an hour.

    I'll never understand how technologists--who claim they are professionals--can leave their own or others' computers unprotected by backups, automatically made ('cause if they're not automatic, they'll never get made).

    Sure, anti-virus and malware detection is important, but my backups are the final defense against miscreants like those who create these malicious invasion methodologies.

    • by Zenin ( 266666 )

      So if you physically rotate the drives...how is that "automatic"?

      More importantly, keep in mind some of the ransomware running around is sneaky, running transparently for weeks or months to ensure that whatever backups are being made have rolled passed their maximum retention and all the new backups are actually encrypted. After a common retention period like 3 months, the malware pulls the plug...deleting the local encryption keep and throwing up a ransom note. "Oh, but I have week's worth of backups, I'

      • by Zenin ( 266666 )

        s/encryption keep/encryption key *sigh*/

      • So if you physically rotate the drives...how is that "automatic"?

        More importantly, keep in mind some of the ransomware running around is sneaky, running transparently for weeks or months to ensure that whatever backups are being made have rolled passed their maximum retention and all the new backups are actually encrypted. After a common retention period like 3 months, the malware pulls the plug...deleting the local encryption keep and throwing up a ransom note. "Oh, but I have week's worth of backups, I'm fine!"...until you realize all those backups are also encrypted...

        Which is why I have URbackup [urbackup.org] running on my LAN backing up all the family computers. It shares no NFS or SMB folders to be infected or tampered with. I have a years worth of quarterly full backups and six months worth of daily incrementals which it stores very efficiently using hard links. It has Windows, Mac and Linux clients. I check it weekly to make sure I don't see a huge spike in incremental data saved which would indicate a ransomware event. The chronically lazy can get reports emailed.

        It won'

      • Not sneaky but thorough. With TSM, we had one malware which went out and deleted the backup copies and another that touched all the files and ran backups multiple times to make sure the original data was gone. When lots of money is involved you should expect that developers will have taken backup strategies into account - they are usually one step ahead of you.
      • by dbIII ( 701233 )
        Luckily the script kiddies deploying the malware so far haven't been trying very hard to hide. Having a copy to a remote site fail due to running out of space because all the filenames are different in the encrypted version of the files was a day one warning in one case I heard about. Also there was a file in every changed directory with instructions on where to send the money - plus the web browser on the original infected host had it's home page changed to a message about where to send the money.
        These m
    • by silverhalide ( 584408 ) on Friday May 12, 2017 @12:35PM (#54406631)

      Ok, but why? Backing up individual PCs is a waste of time and resources in the high-speed network era.

      Train your users that it's 2017, workstations are disposable and may disappear at any given moment. If their shit isn't saved on the network NAS or in $CloudDriveProvider, it doesn't exist. Restoring should be just re-imaging a computer and signing back into relevant accounts.

      Windows has had seamless server file storage redirection for years, so you don't even really have to train them, just redirect My Documents and Desktop to the fileserver.

      Ditch MS office already. It's 2017 and there is absolutely no excuse for these types of vulnerabilities anymore. It doesn't do anything useful that Google Docs does, unless you consider spreading malware useful.

      • by Zenin ( 266666 ) on Friday May 12, 2017 @12:58PM (#54406761) Homepage

        1) A LOT of workstations include not just data, but a lot of specific configuration. That's especially true of those used in the medical field where they're used to control equipment, but it's also very true for any user more advanced than an office drone. Simply re-imaging them won't get them anywhere remotely close to a functional state.

        2) Simply saving to network/cloud drive won't save you from ransomware; They'll simply encrypt every NAS/cloud storage the user has access to. Often it can greatly exacerbate the problem because if/when a server attached to that NAS gets infected...it can encrypt the entire company's data at a much, much faster rate than local PCs and doesn't need to infect all those individual machines or wait for them to be powered on. Cloud storage is even worse in this regard, because access keys can be jacked and the storage reached externally by bot clusters.

        Also, NAS is dead...long live hybrid solutions. Panzura, StorSimple, etc. Still, it requires massively upgraded networks, both LAN and WAN connectivity, to adequately replace local storage with remote for hundreds or thousands of users.

        A much more legitimate response would be something like AWS WorkSpaces, but again local machine controllers often won't be able to use those solutions.

        3) Who the hell uses My Documents? Despite MS pushing it for ages, real world usage shows almost everyone (especially non-power users) saving everything to their desktop.

        4) Ditch MS Office, haha that's funny. Clearly, you don't work in any company larger than a few dozen employees.

        • by dbIII ( 701233 )

          2) Simply saving to network/cloud drive won't save you from ransomware; They'll simply encrypt every NAS/cloud storage the user has access to.

          It allows an economy of scale approach to dealing with the problem.
          More capable systems with different features now have access to the files, so now you can have snapshotting and access to external storage, such as tape, which is not going to all be online at once if the whole thing gets compromised. Doing that on a PC level is a bit of messing about, but on a shared

      • by mspohr ( 589790 )

        Ditch MS Office
        Use Google Docs
        Workstations are disposable... just re-image and sign back in

        Sounds like a good prescription for Chromebooks

    • by Anonymous Coward

      Yeah great if you work for a tiny company, try the same with 100/1000/10000/100000 desktops...

      • by mspohr ( 589790 )

        Throw out the desktops. Give everyone Chromebooks. No management issues.
        Just sign in and you're good to go.

        • by Zenin ( 266666 )

          Serious question: Why do so many computer geeks actually believe every computer user 'lessor' than them doesn't use applications more specialized than a web browser?

          I'm sure that Chromebook will be great for updating your resume...after you're fired for crippling the company as practically no enterprise applications will run on those toys. Alternative applications are either non-existent, not nearly functional enough, too expensive, require costly retraining, or most often some combination of those faults.

          • by mspohr ( 589790 )

            If an enterprise has locked themselves into applications that run only on Windows, they are stupid and deserve to pay Bitcoin ransom for their stupidity. The writing has been on the wall for many years and most app vendors who are not luddites have (at a minimum) a web version of their software.
            Chromebooks have no need for desktop management. It's much easier to manage the network that a bunch of malware infested Windows boxen.

            • by dbIII ( 701233 )

              If an enterprise has locked themselves into applications that run only on Windows, they are stupid

              Maybe, but it happens A LOT.
              Also due to the moving target nature of MS Windows that means you get some of these applications that only work on specific versions as these vital applications. I have two users still on MS Windows XP - one to run an electronic testing application and another for a label printing program. They can still run MS Office 201*, firefox, thunderbird etc and don't need a lot of memory so

              • Unfortunately true.
                Lazy admins let this slide.
                Really? A label printer? WTF You can't find a label printer program?
                State of the art 20 years ago is a threat to the Enterprise today.

                • by dbIII ( 701233 )
                  "Lazy admins" don't get to set policy, as you should know with a userid that low.
                  Then again you should have known better than the advice to pay bitcoin to criminals and continue to encourage them.

                  to the Enterprise today

                  It's MS Windows. The only bit where it looks like an "Enterprise" is software falling over like disposable redshirts.

                  • by mspohr ( 589790 )

                    Yes, sorry, I used the term "admins" but they are not really responsible... they just admin what they are given. They can make recommendations to the CTO managers who are the real culprits. The C level people are fat and lazy and not doing their job. It would take work and thinking and planning and money to fix their enterprise but they are lazy and cheap. They are just sliding by and hoping that nothing bad happens to the house of cards they have built on dodgy Windows software.

                    Unfortunately, Windows IS en

      • "Yeah great if you work for a tiny company, try the same with 100/1000/10000/100000 desktops..."

        Economies of scale makes it cheaper per desktop the more you have ...

    • I am waiting for the generation of ransomware which installs a shim driver that transparantly encrypts documents, but allows the user to access them for a certain period time (so all backups in 30-90 days are useless), then at a date/time, purges the keys, and springs the trap.

      I would say that these days, I'd consider a much longer backup rotation with snapshots kept for years just in case.

      I also would look at a "pull" backup mechanism, a client that the server contacts. That way, unlike backing up to a sh

      • So, a business is going to survive the loss of 30-90 days of work?

      • by dbIII ( 701233 )

        I am waiting for the generation of ransomware which installs a shim driver that transparantly encrypts documents, but allows the user to access them for a certain period time (so all backups in 30-90 days are useless

        You are waiting for criminals who will wait around for a long time, risking discovery by various traces and backtracking, instead of demanding money now. I think you'll be waiting for a while.
        It sounds like a really cool plot but I think we are still in "take the money and run" territory here i

      • I am waiting for the generation of ransomware which installs a shim driver that transparantly encrypts documents, but allows the user to access them for a certain period time (so all backups in 30-90 days are useless), then at a date/time, purges the keys, and springs the trap.

        Back when dinosaurs ruled the Earth, there was Ashton Tate's dBASE running under MS-DOS.

        Who cares? Because there was a TSR (Terminate and Stay Resident) virus you could get that intercepted .DB file I/O. When it saw write activity, it occasionally changed some data in the outgoing buffer but also remembered the exact position and bytes changed into a hidden file. When reading damaged blocks, it would revert those changes.

        So the user effect was absolutely nothing. And the more you (unsuspectingly) us

    • by Anonymous Coward

      backing up workstations? what the fuck for?

      you sound like a blow hard, and the whole comment is probably bullshit.

  • I don't use a fancy-pants PDF reader that gives a crap, and I don't have Office installed, either.

    Even on Windows this is a non-scary problem for anyone who knows anything.

    Roll on job security.

  • Why doesn't the article ever mention that this affects Windows only? Or is it just assumed these days that malware is only for Microsoft users?
    • by dbIII ( 701233 )

      Or is it just assumed these days that malware is only for Microsoft users?

      It's normally a fairly safe assumption since the rare mac or *nix security problems get a label applied.

  • I have a theory that the punishment should be in proportion to the crime. When you are trying to fleecs 5M people an hour then you qualify for a Putin style polonium hit. It would really send a message and help reduce this type of thing.

"So why don't you make like a tree, and get outta here." -- Biff in "Back to the Future"

Working...