The latest version of the scam scourge known as CryptXXX, raked in more than $45,000 (£34,344) in less than three weeks.
Over the past few months, CryptXXX developers have gone back and forth with security researchers. The whitehats from Kaspersky Lab provided a free tool that allowed victims to decrypt their precious data without paying the ransom, which typically reaches $500 or more. Then, CryptXXX developers would tweak their code to defeat the get-out-of-jail decryptor. The researchers would regain the upper hand by exploiting another weakness and so on.
Earlier this month, the developers released a new CryptXXX variant that to date still has no decryptor available. Between June 4 and June 21, according to a blog post published Monday by security firm SentinelOne, the Bitcoin address associated with the new version had received 70 bitcoins, which at current prices is valued at around $45,228. The figure doesn’t include revenue generated from previous campaigns.
“With this kind of success, it’s likely we’ll continue to see this family and other ransomware families continue to grow and evolve,” SentinelOne researchers wrote. “Some factors which may contribute to this are the increasing reliance on computers to store and process valuable information and the increasing popularity of Bitcoin which is semi-anonymous, works globally, and is difficult to regulate because it’s completely decentralized.”
RELATED: FTC Returns More Than $6 Million to Consumers Who Bought Infomercial Weight-Loss Book
The chief change introduced with the new version is an encryption scheme that isn’t easily broken. That scheme prevented the currently available decryptor tools provided by Kaspersky from working. The variant still allows victims to decrypt a single file, although the size is limited to 512 KB. Other changes include (1) the extension .crypt1 being added to all encrypted files instead of the previous .crypz and .crypt and (2) the deletion of shadow volume copies on the victim’s system, a move that prevents the data from being restored from backups. The new variant is likely spreading through blasts of spam, but SentinelOne said the attackers may be relying on other distribution methods as well.
Funds flowing into the address being monitored are regularly transferred into a new, unique address, suggesting the CryptXXX operators may be using a Bitcoin tumbler to mask where the coins are going. The $45,000 rough estimate helps explain why crypto ransomware has emerged as one of the top computer security threats in recent months. On Friday, researchers with security firm ProofPoint disclosed their discovery of a new strain dubbed Bart. This problem is likely to get worse before it gets better.
Are you a victim of fraud or money scam? Share your story with us on the Money Credit and You Facebook page!
Original article published on Arstechnica.com.
