Ransom Aware: Kaspersky Lab Detected A 14% Increase In New Ransomware Modifications In Q1 2016

Kaspersky Lab’s database now includes about 15 thousand ransomware modifications and the number continues to grow.

In the first quarter of 2016, Kaspersky Lab security solutions prevented 372,602 ransomware attacks on users, 17 percent of which targeted the corporate sector. The number of attacked users increased by 30 percent compared to Q4, 2015.

One of the most famous and widespread ransomware in Q1, 2016 was Locky. Kaspersky Lab products detected attempts to infect users with this Trojan in 114 countries, and as of early May 2016 it remains active.

Another ransomware called Petya was interesting from a technical perspective because of its ability not only to encrypt data stored on the computer, but also to overwrite the hard disk drive’s master boot record (MBR), leaving infected computers unable to boot into the operating system.

According to Kaspersky Lab detections the top three ransomware families in Q1 were: Teslacrypt (58.4%), CTB-Locker (23.5%), and Cryptowall (3.4%). All three propagate mainly through spam emails with malicious attachments or links to infected web pages.

“One of the reasons why ransomware has become so popular lies in the simplicity of the business model used by cybercriminals. Once the ransomware gets into the users’ system there is almost no chance of getting rid of it without losing personal data. Also, the demand to pay the ransom in bitcoins makes the payment process anonymous and almost untraceable which is very attractive to fraudsters. Another threatening trend is the Ransomware-as-a-Service (RaaS) business model where cybercriminals pay a fee for the propagation of malware or promise a percentage of the ransom paid by an infected user,” says Aleks Gostev, Chief Security Expert in the Global Research and Analysis Team (GReAT).

There is a further reason for the rise in ransomware attacks: users believe the threat is unbeatable. Businesses and individuals are not aware of the technology countermeasures that could help to prevent infection and the locking of files or systems; and by ignoring basic IT Security rules they allow cybercriminals and others to profit.

Alongside an overview of the major ransomware outbreaks, Kaspersky Lab has counted the overall level of cyberthreats in Q1 2016 globally.

According to Kaspersky Security Network data, the malware landscape in Q1 2016 was the following:

• Kaspersky Lab products blocked a total of 228 million malicious attacks on computers and mobile devices.
• 2 percent of Internet users faced web-based attacks at least once, which is 1.5 percentage points lower than in Q4, 2015.
• 5 percent of Kaspersky Lab solutions users faced a malicious threat at least once, which is a 0.8 percentage point increase on Q4, 2015.
• Kaspersky Lab solutions protected 459,970 users from cybercriminals’ fraudulent attempts to access online banking services and steal their money. This is a 23 percent decrease compared with the previous quarter.
• Cybercriminals continued to use vulnerabilities in Adobe Flash Player, Internet Explorer and Java to propagate malware. Less frequently, they used exploits for Java – according to our statistics this has decreased by 3.3 percentage points on Q4, 2015 and equals 8% of overall exploit statistics for Q1. The same statistics registered an increased use of vulnerabilities in Flash (a rise of 1 percentage point which is 6% in total) and Microsoft Office (an increase of 10 percentage points which is 15% in total).

All the statistics used in this report were obtained using Kaspersky Security Network (KSN), a distributed antivirus network that works with various anti-malware protection components. The data was collected from KSN users who agreed to provide it. Millions of Kaspersky Lab product users from 213 countries and territories worldwide participate in this global exchange of information about malicious activity. This includes users from the Philippines.

10 tips to protect your files from ransomware

To avoid dealing with consequences brought by ransomware, here are 10 simple tips to protect your data from this stealthy malware:

1. Always back up your files. Make sure that you back up your important files regularly. It is highly recommended that you create two back up copies: one to be stored in the cloud (using services like Dropbox, Google Drive, etc.) and the other recorded to a physical means of storage (portable hard drive, thumb drive, extra laptop, etc.).

2. Check your back up files. Regularly check that your back up copy is ok. There are times when an accidental failure can inflict damage to your files.

3. Be keen with attachments. Cybercriminals often distribute fake email messages mimicking email notifications from an online store or a bank, luring a user to click on a malicious link and distribute malware. This method is called phishing. With that in mind, fine-tune your antispam settings and never open attachments sent by an unknown sender.

4. Trust no one, literally. Malicious links can be sent by your friends on social media, your colleague or online gaming partner whose accounts have been compromised in one way or another.

5. Enable ‘Show file extensions’ option in the Windows settings. This will make it much easier to distinguish potentially malicious files. As Trojans are programs, you should be warned to stay away from file extensions like “exe”, “vbs” and “scr”.You need to keep a vigilant eye on this as many familiar file types can also be dangerous. Scammers could use several extensions to masquerade a malicious file as a video, photo, or a document (like hot-chics.avi.exe or doc.scr).

6. Regularly update your operating system, browser, antivirus, and other programs. Culprits tend to exploit vulnerabilities in software to compromise systems.

7. Use a robust antivirus program. Choose solutions that prevent viruses from getting into your computer, or, should the virus infiltrate your system after all, protect important files using its special capability.

8. If you discover a rogue or unknown process on your machine, cut off the Internet connection immediately. If the ransomware did not manage to erase the encryption key from your computer, there’s still a chance you can restore the files. However, the new strains of this type of malware use a predefined key, so this tip, unfortunately, would not work in that case.

9. Don’t pay the ransom. If you are unlucky to have your files encrypted, don’t pay the ransom, unless the instant access to some of your files is critical. In fact, each payment fuels this unlawful business which would prosper as long as you pay money.

10. Know the malware’s name. If you have been infected by ransomware, you should try to find out the name of the malware: maybe it’s an older version and it is relatively simple to restore the files. Ransomware used to be less advanced in the past.Moreover, the police and cybersecurity experts (including those working for Kaspersky Lab) collaborate to detain the adversaries and provide file restoration tools online. Some people have an opportunity to decrypt their files without having to pay the ransom. To check whether it’s possible, visit com.

The full Q1 cyberthreats report is available at Securelist.com.