Just as the reverberations from last week’s WannaCry ransomware outbreak have started to slow, a new threat has already cropped up. A virulent ransomware strain called XData has gained momentum in Ukraine, so far leading to about three times as many infections as WannaCry did in the country. That XData appears to target Ukraine specifically tempers some fears, but were it to spread globally it would potentially leave even more devastation than last week’s WannaCry mess.
Discovered on Thursday by MalwareHunter, a researcher with the MalwareHunterTeam analysis group, XData had 94 detected unique infections as of midday Friday, and the number was rising. In contrast, MalwareHunterTeam’s data indicates that there were less than 30 WannaCry infections in Ukraine in all (the total number of infections worldwide was about 200,000). A few dozen cases may not sound like a lot. But considering that WannaCry infected 200,000 devices out of the billions of devices in the world, rate of infection is an important indicator. An outbreak moving this much faster than WannaCry did, even in an isolated setting, portends deeper troubles if it goes global.
“As it spread that fast in the Ukraine, it is not unlikely that it will spread fast outside of Ukraine, too,” says German security researcher Matthias Merkel.
Experts are still analyzing the ransomware to identify how it infects devices and spreads, but so far XData shows at least some level of sophistication. That’s in contrast to WannaCry, whose creators’ incompetence limited its scope. Researchers have confirmed that XData fully encrypts the files it claims to, and that there isn’t a way to get around the process and decrypt the files for free, as you can with WannaCry in some cases on Windows XP and Windows 7.
XData’s ransom note is simply in a text file instead of showing up as a window plastered across a victim’s screen. Merkel notes that the ransomware regularly closes all processes running on infected devices except for itself, but it seems that it may not connect to the internet after it infects a device. If that’s the case then it probably doesn’t have the worm-like qualities of WannaCry and is relying on a different mechanism to generate new infections. Usually that would be something like spam, malvertising, or tainted software a user unknowingly downloads, but the rate of infection in Ukraine indicates that there may be an additional driver.
Curiously, XData doesn’t specify an amount of money it requires to release hostage files. MalwareHunter speculates that the attackers may set the ransoms on a victim-by-victim basis, depending on whether they are individuals or businesses.
The XData focus on Ukraine has kept the ransomware at least somewhat contained. And researchers caution that it’s too early to predict how effective it would be outside the country, since so much remains unknown about the mechanics of XData attacks. Researchers at Symantec said on Friday that they had evaluated two XData-related samples, and confirmed that it is currently “highly active” in Ukraine and Russia. But they hadn’t yet determined whether the ransomware was exploiting a particular software vulnerability to infect devices.
WannaCry notoriously exploits the Windows server vulnerability known as EternalBlue, which surfaced in a leak of stolen NSA spy tools published by the Shadow Brokers hacking group. Microsoft had patched the bug in mid-March, but WannaCry preyed on devices that didn’t have the fix installed. Victims included the UK’s National Health Service, various European telecoms, and thousands more victims in 150 countries around the world.
Perhaps counterintuitively, XData turning out to leverage the same EternalBlue exploit would be for the best, given the general awareness at this point of the need to patch that particular bug. It’s a known problem. “I want to believe they are exploiting [the same flaw], says MalwareHunter, “because if not, and they still got that crazy amount of victims, that is really bad.”
Even if XData doesn’t have the same efficacy on the world stage (fingers crossed), it still highlights the larger reality that new ransomware families, each with their own tweaks and modifications, constantly surface and affect some number of victims. And attackers learn from both successes and failures. WannaCry showed just how bad things can get when relatively unknown ransomware has the right infection strategy at the right time. It won’t be the last to do so.
Now researchers are analyzing, watching and waiting to see what happens next with XData. The rate of infection ebbs and flows hour to hour, but has been steadily rising overall. “Imagine what would happen if they targeted everyone,” MalwareHunter says.
What is Ransomware and How Do You Deal With It?
GoldMint to Launch ICO with Early Bird Bonuses
The GoldMint company (the innovator behind the stable GOLD token and Custody Bot) has published its plans for its greatly anticipated ICO. The ICO will launch on September 20, beginning with the sale
The Newest Version of the Opendime Bitcoin Wallet Is Out
Coinkite is launching a new version of its Opendime bitcoin hardware wallet.
The third iteration of the popular USB stick wallet, the latest model will feature a range of changes on the hardware fr
Crypto Bloodbath: Bitcoin Back to $3,950 After Dipping Below $3,800
Since achieving a new all-time high above $4,500, bitcoin price has recorded four minor corrections. Earlier today, on August 22, bitcoin price fell to $3,800 as the market and investors started to fe
Bitcoin Cash: Chinese ‘Big 3’ Exchanges Huobi & OKCoin Launch Trading
Two of China’s ‘big three’ cryptocurrency trading platforms are now officially supporting Bitcoin Cash (BCC) after launching trading today.
In official announcements today, Huobi and OKCoin began s
US Telcos Targeted by Hackers in an Attempt to Empty Cryptocurrency Wallets
Cryptocurrency users have always been a tempting target for cybercriminals. Since none of these currencies have reversible transactions, stealing money is a guarantee for success. It now appears
Boldstart Founder Launches Hyperledger Fabric's First Blockchain Accelerator
The founder of VC firm Boldstart Ventures is launching the first accelerator dedicated exclusively to startups building on the Hyperledger Fabric blockchain.
With previous exits that include a $120
Blockchain ID Startup ShoCard Raises $4 Million in New Funding
Blockchain startup ShoCard has raised $4 million in new funding from a range of investors.
Co-led by AME Cloud Ventures and Morado Venture Partners, two of the company's existing stakeholders, the
Walmart, Kroger & Nestle Team with IBM Blockchain to Fight Food Poisoning
Several of the world's largest food suppliers are collaborating on a blockchain solution that could one day save both money and lives.
In partnership with IBM, the consortium – which includes Dole,