Just as the reverberations from last week’s WannaCry ransomware outbreak have started to slow, a new threat has already cropped up. A virulent ransomware strain called XData has gained momentum in Ukraine, so far leading to about three times as many infections as WannaCry did in the country. That XData appears to target Ukraine specifically tempers some fears, but were it to spread globally it would potentially leave even more devastation than last week’s WannaCry mess.
Discovered on Thursday by MalwareHunter, a researcher with the MalwareHunterTeam analysis group, XData had 94 detected unique infections as of midday Friday, and the number was rising. In contrast, MalwareHunterTeam’s data indicates that there were less than 30 WannaCry infections in Ukraine in all (the total number of infections worldwide was about 200,000). A few dozen cases may not sound like a lot. But considering that WannaCry infected 200,000 devices out of the billions of devices in the world, rate of infection is an important indicator. An outbreak moving this much faster than WannaCry did, even in an isolated setting, portends deeper troubles if it goes global.
“As it spread that fast in the Ukraine, it is not unlikely that it will spread fast outside of Ukraine, too,” says German security researcher Matthias Merkel.
Experts are still analyzing the ransomware to identify how it infects devices and spreads, but so far XData shows at least some level of sophistication. That’s in contrast to WannaCry, whose creators’ incompetence limited its scope. Researchers have confirmed that XData fully encrypts the files it claims to, and that there isn’t a way to get around the process and decrypt the files for free, as you can with WannaCry in some cases on Windows XP and Windows 7.
XData’s ransom note is simply in a text file instead of showing up as a window plastered across a victim’s screen. Merkel notes that the ransomware regularly closes all processes running on infected devices except for itself, but it seems that it may not connect to the internet after it infects a device. If that’s the case then it probably doesn’t have the worm-like qualities of WannaCry and is relying on a different mechanism to generate new infections. Usually that would be something like spam, malvertising, or tainted software a user unknowingly downloads, but the rate of infection in Ukraine indicates that there may be an additional driver.
Curiously, XData doesn’t specify an amount of money it requires to release hostage files. MalwareHunter speculates that the attackers may set the ransoms on a victim-by-victim basis, depending on whether they are individuals or businesses.
The XData focus on Ukraine has kept the ransomware at least somewhat contained. And researchers caution that it’s too early to predict how effective it would be outside the country, since so much remains unknown about the mechanics of XData attacks. Researchers at Symantec said on Friday that they had evaluated two XData-related samples, and confirmed that it is currently “highly active” in Ukraine and Russia. But they hadn’t yet determined whether the ransomware was exploiting a particular software vulnerability to infect devices.
WannaCry notoriously exploits the Windows server vulnerability known as EternalBlue, which surfaced in a leak of stolen NSA spy tools published by the Shadow Brokers hacking group. Microsoft had patched the bug in mid-March, but WannaCry preyed on devices that didn’t have the fix installed. Victims included the UK’s National Health Service, various European telecoms, and thousands more victims in 150 countries around the world.
Perhaps counterintuitively, XData turning out to leverage the same EternalBlue exploit would be for the best, given the general awareness at this point of the need to patch that particular bug. It’s a known problem. “I want to believe they are exploiting [the same flaw], says MalwareHunter, “because if not, and they still got that crazy amount of victims, that is really bad.”
Even if XData doesn’t have the same efficacy on the world stage (fingers crossed), it still highlights the larger reality that new ransomware families, each with their own tweaks and modifications, constantly surface and affect some number of victims. And attackers learn from both successes and failures. WannaCry showed just how bad things can get when relatively unknown ransomware has the right infection strategy at the right time. It won’t be the last to do so.
Now researchers are analyzing, watching and waiting to see what happens next with XData. The rate of infection ebbs and flows hour to hour, but has been steadily rising overall. “Imagine what would happen if they targeted everyone,” MalwareHunter says.
What is Ransomware and How Do You Deal With It?
Banks Buy Stakes in Blockchain Startup SETL
Financial services group Citi has bought a stake in blockchain startup SETL.
The move, announced today, comes less than three weeks after the French banking institution Credit Agricole also became
Long Blockchain Is At Risk for Exchange Removal Again
Long Blockchain, the beverage company-turned-crypto-firm, is facing a delisting from the Nasdaq stock exchange, public records show.
The reason lies in Long Blockchain's sliding stock price, which
Bitcoin thieves threaten real violence for virtual currencies
The currency they were after was virtual, but the guns they carried were anything but. In the beach resort of Phuket, Thailand, last month, the assailants pushed their victim, a young Russian man,
Lithuania's Central Bank Probes 100 Million Euro ICO
Lithuania's central bank announced last week that it is probing a domestic initial coin offering (ICO) after determining that the token offered counts as a security.
In a Feb. 15 statement, the Lie
Record Retest? ETC Looks Poised on Double-Digit Climb
ETC, the native currency of the ethereum classic blockchain, looks set to re-test record highs, having now formed a base above $30.
As of writing, ETC is changing hands at $37.90, as per data sourc
$850 Million Raised in ICO So Far, Says Telegram
Messaging app provider Telegram says it has raised $850 million in the first part of its controversial initial coin offering (ICO), public records show.
If confirmed, the raise is by far the larges
Bottom Confirmed? Bitcoin at 20-Day High Near $11K
The bitcoin price has rallied 84 percent from recent lows, suggesting a bottom is in place, although a long-term bull revival is still not certain, according to the price charts
Over the weekend, C
Australian Watchdog Received 1,200 Crypto Scam Complaints in 2017
Australia's consumer watchdog has reportedly received over 1,200 complaints about cryptocurrency scams in 2017.
According to the ABC's current affairs program 7.30, data obtained from the Australia