Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Wednesday, 4 October, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Breaking Bad-themed 'Los Pollos Hermanos' crypto ransomware found in the wild

by The Gurus
May 11, 2015
in Editor's News
Share on FacebookShare on Twitter

A new crypto ransomware threat that uses the ‘Los Pollos Hermanos’ branding image found in the show ‘Breaking Bad’ has been discovered. Currently infecting computers in Australia, the malware encrypts images, videos, documents, and more on the compromised computer and demands up to AU$1,000 (US$791) to decrypt these files.
Discovered by Symantec, the malware arrives through a malicious zip archive, which contains a malicious file called ‘PENALTY.VBS’ (VBS.Downloader.Trojan) which when executed, downloads the crypto ransomware onto the victim’s computer. The threat also downloads and opens a legitimate .pdf file to trick users into thinking that the initial zip archive was not a malicious file.
According to Symantec researchers, the malware encrypts files using a random Advanced Encryption Standard (AES) key. This key is then encrypted with an RSA public key so that victims can only decrypt their files by obtaining the private key from the attackers.
Sagie Dulce, security researcher at Imperva pointed out that the techniques of this attack show how effective social engineering is when creating successful ransomware campaigns. “The hackers don’t use any exploits to infect the victim’s machine. The victim downloads a zipped archive that contains a malicious script. Once the script is run by the victim it downloads the ransomware and opens a PDF in order to trick the victim into thinking that “nothing bad happened”. Additionally, the hackers seem to be using open source PEN testing tool to execute their own PowerShell scripts on the compromised computer.
“This shows how compromises, similar to ones expected from sophisticated hacker groups, can be achieved by simple social engineering and a few scripts. The hackers didn’t use any exploits or spend money on advanced tools.”
TK Keanini, CTO Lancope, urged users not to pay the ransom. “This will continue until folks stop paying.  The exchange of money needs to stop before this activity stops.  Every time someone pays the ransom, they fund this cybercrime business!  Stop paying, and they will need to find another way to make their money.”
Mark James, security specialist at ESET said that companies to be extra vigilant with email attachments and to educate employees. “Keeping your staff up to date on these new variants and ensuring they are all aware of the latest methods or techniques used to infect will help combat these bad guys. Ensuring your Antivirus software, operating system and all other applications are updated regularly will also help to keep you safe.”
 

FacebookTweetLinkedIn
Tags: breaking badcryptoCyberCyber SecurityEncryptionESETHackersImpervainformation securityinfosecinfosecurityLancopeRansomwareSymantec
ShareTweet
Previous Post

Cutting Through the RSA Conference Jargon: Cybersecurity Lessons for the C-Suite

Next Post

Facebook users hit with See ‘What Happens to this Pregnant Lady’ video scam

Recent News

Cybersecurity has become the fastest growing start-up sector in UK

UK SME cyber threat concerns on the rise in last 12 months as a quarter admit to being breached

October 3, 2023

The State of Cybersecurity: Cyber skills gap leaves business vulnerable to attacks, new research reveals

October 3, 2023
threat hunting

Threat Hunting with MITRE ATT&CK

October 2, 2023
Guide to ransomware and how to detect it

Guide to ransomware and how to detect it

September 28, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information