This important notification is being released by Trend Micro for AWARENESS of the Ransomware Cryptolocker family. The main purpose of this Threat Awareness is to provide complete information about the threat and communicate the recommended solutions and best practices so that customers can apply them and avoid being affected or contain the threat from spreading further. If similar infections are being experienced in your respective regions, please contact your support engineer.
Threat brief
We are experiencing a resurgence of the malware family named Cryptolocker (and others variant). This is a crypto-ransomware variant which has the capability to encrypt files. It uses many technics (HTTPS, P2P, TOR…) to mask its command-and-control (C&C) communications. Usually, this attack is delivered thought spear-phishing method as an email attachment. Upon execution, it connects to several URLs to download the crypto-ransomware. It displays a ransom message. Users must pay the ransom before the set deadline is done. Otherwise, all the files will permanently remain encrypted. But beware, ransom payment is no guarantee that the original files will be restored!
Notable Variant • A particular variant, TROJ_CRYPCTB.XX , offers users the option of decrypting 5 files for free—as proof that decryption is possible. • Users are also given 96 hours, instead of 72 hours, to pay the ransom fee. • The displayed ransom message has options for four languages, namely, English, Italian, German and Dutch. • In some case, infection could occur through embedded URL over email or compromised web site with drive-by download technics.
How to protect from CRYPTOLOCKER attack ? • Use Reputation for real-time protection using cloud automatic sharing system (Smart Protection Network)
◦ Email Reputation to block malicious and suspicious email. ◦ Web Reputation to block compromised websites, newly C&C remote hosts and other disease vectors. ◦ File Reputation through SmartScan technology for real-time security updates on your solutions.
• Leverage sandbox, emulation and heuristic integration in current Trend Micro product with Custom Defense approach
◦ Automatic execution of suspicious content on innovative dynamic engines ◦ Native & easy deployment to existing Trend Micro solutions (OffiScan, IMSva, IWSva, ScanMail…) ◦ Empower Deep Discovery approach to detect over network any cryptolocker attack, ransomware, 0-day, targeted attack and any others unkown malware/variant
• Apply Best Practices on your Trend Micro solutions ◦ Block potentially dangerous file over email (exe, scr, cab filetype…) ◾IMSva : ◾WFBS & ScanMail :
◦Tune Endpoint security solutions with Trend Micro recommendations ◾Malware : ◾Ransomware :
•Education to end-user is key to pro-active defense: ◦ Always check who the email sender is. ◦ Double-check the content of the message. ◦ Refrain from clicking links in email. ◦ Backup important data.
• Coming soon into OfficeScan 11 Service Pack 1 !!! Anti-Cryptolocker feature to protect your personal file against encryption or malware action. Beta will start in few weeks. Contact your support engineer for more information.
How te remediate if Cryptolocker infection is running ? • Détection and removal tool for Cryptolocker :
• Most of the time, encrypted personal file are lost even if user pays the ransom. Backup restore is the best solution to retrieve original and unmodified personal files. • For Windows users, in case of system backup & restore features were active, lost files could be restored based on last automatic backup :
If you have any queries about Trend Micro Solutions and the Ransomware Cryptolocker family, call our support team on 0118 9898 245.