In their June Online Fraud Report RSA reports on the activity of online fraudsters, full summary below.

RSA researchers have been following Ransomware campaigns and Ransomware Trojan attack waves and have recently analyzed a new variant that holds infected PCs hostage until their owners make a €100 payment to the botmaster.

Ransomware is the type of malware that can infect a PC and then lock the user’s data most commonly by encrypting files or by injecting a rogue MBR (master boot record) to the system’s start-up routine.

Ransomware can come as standalone malicious code or coupled with other malware. This type of malicious campaign has been on the rise and are ever popular, with many recent cases combining banking Trojans with Ransomware. While the user’s files are typically locked until the ransom is paid, the victim is still free to browse the Internet, thus allowing the banking Trojan to continue collecting information on the victim uninterrupted.

The Trojan involved in the cases studied by RSA is a Ransomware that begins by checking for the future victim’s geo-location and adapting a ransom page to the local language for thirteen different countries. The fact that this malware aims at 13 specific countries may seem targeted enough at first sight, but it is only the case of one variant – if this malware is shared or sold with other criminals, they could easily adapt it to their own targets.

RSA researchers were able to recognize 13 different ransom kits available for this Trojan. All kits are located in the same folder, where some countries have two different types of images that can be downloaded and used by the Ransomware (in cases when more than one language is spoken in that country, such as Belgium).

After the Ransomware kit infected the PC, it was downloaded and unpacked locally. This is the point at which the Trojan begins its primary communication with the botmaster’s remote server.

The communication includes three main purposes:

  1. Inform the botmaster of the addition of a new bot, send infected machine’s IP address (and then used to define the infected PC’s physical location)
  2. Obtain a blacklist of potentially fake prepaid card/voucher numbers defined by the botmaster
  3. Ping the botmaster to use the C&C as a drop for the coming ransom payment (in the shape of a card PIN/voucher number)

This Trojan also makes a few copies of itself and saves them under different names locally on the infected PC.

Much like other Trojans, this Ransomware is managed via server side scripts on the botmaster’s resources. The variant analyzed in this case used four resources, all of which were located on the same physical server, using two different IP addresses held with a Russian-based ISP – typical for the vast majority of Ransomware.

RSA was able to deduce that the Ransomware analyzed is actually part of a larger cybercrime operation. The botmasters behind this malware variant are clearly bot-herding and monetizing their botnets using a loader Trojan, banking Trojans and Ransomware variants. The server hosting the Ransomware has proven to also be a drop zone for stolen credentials amounting to well over €80,000.

RSA Conclusion

Ransomware has been gaining speed among cybercriminals and bot-herders, likely because this extortion method works and keeps paying off, as victims believe that if they pay, their system will be unlocked.

With ransom amounts averaging €100, it seems as though botmasters behind these scams keep the fee relatively low, possibly so that the victim may prefer to pay it in hopes of releasing the hold on their PC rather than contact a support professional. Another factor keeping victims quiet are typical Ransomware accusations, including things such as software and music infringement. It is very possible that users do not know they were infected by malware and are not keen on contacting someone about it, thus allowing this type of malware to enjoy its continued popularity.

Phishing Attacks per Month

In May 2012, phishing volume increased by 7%, with a total of 37,878 global attacks identified by RSA. The bulk of the increase observed in the past two months is a result of highly targeted phishing campaigns launched against a small number of financial institutions.

Number of Brands Attacked

The number of brands targeted by phishing attacks throughout May increased by 4%, and 50% endured less than five attacks.

Types Attacked

Phishing attacks against U.S. nationwide bank brands decreased by 20% while credit unions saw a 13% increase in phishing volume in May.

Top Countries by Attack Volume

After being targeted by 28% of worldwide attacks in April, Canada saw a huge drop in attack volume in May to just 3%. The UK remains the most heavily targeted country for the third consecutive month, enduring more than 60% of global phishing volume in May.

Top Countries by Attacked Brands

The countries with the most attacked brands in May were the U.S., UK, and Australia, accounting for 47% of all phishing attacks. Brands in Brazil, India, Canada, China, France and Italy also continue to remain highly targeted by phishing.

Top Hosting Countries

The U.S. saw an increase of10% in the number of phishing attacks it hosted in May – increasing to 66%, or two out of every three attacks. Brazil also remained a top host with 9% and Germany with 4%.

Previous RSA Online Fraud Report Summaries:

  • The RSA April 2012 Online Fraud Report Summary here.
  • The RSA March 2012 Online Fraud Report Summary here.
  • The RSA February 2012 Online Fraud Report Summary here.
  • The RSA January 2012 Online Fraud Report Summary is here.
  • The RSA December 2011 Online Fraud Report Summary is here.
  • The RSA November 2011 Online Fraud Report Summary is here.
  • The RSA October 2011 Online Fraud Report Summary is here.
  • The RSA September 2011 Online Fraud Report Summary is here.