Results for crypto ransomware

Threat Research

"JapanLocker": An Excavation to its Indonesian Roots

Fortinet has discovered a new open-source PHP ransom malware that has been targeting web sites using a simple encryption algorithm that is effective enough to really frighten web server owners. What is more interesting, however, is the information we have uncovered regarding the possible roots of the attacks/attackers. Basing only on the email address that it uses for ransom negotiations, “japanlocker@hotmail.com”, victims and researchers alike may make an obvious guess where the attacks may have come from. However, our investigation...

Threat Research

Dissecting Mamba, the Disk-Encrypting Ransomware

  Another new ransomware has joined the file-encrypting bandwagon. Only this time, instead of choosing what types of files to encrypt, it has decided to join the league of a few others and encrypt the entire disk directly using an open-source tool called DiskCryptor. This is not the first time that disk-encrypting ransomware has hit the spotlight. Earlier this year, Petya ransomware wreaked havoc by encrypting disks through the master file table (MFT), denying access to user files. Unlike that former attack, however, this new ransomware...

By Joie SalvioSeptember 27, 2016

Threat Research

Insights on TorrentLocker

Summary During the last weeks there have been several cases of international brand names being used by malware authors to propagate malware through phishing emails. These emails contain misleading links that download malicious Zip files, which, in turn, contain a JavaScript file that downloads the TorrentLocker ransomware. The malicious files have been detected as JS/Agent.2867!tr or JS/Nemucod.AFA!tr.dldr or JS/Nemucod.AFE!tr.dldr by the Fortinet Antivirus service. Since most of the available reports about this threat cover the encryption...

By Lilia Elena Gonzalez MedinaJuly 25, 2016