Comodo Threat Intelligence Lab SPECIAL REPORT: SEPTEMBER 2017 – RANSOMWARE PHISHING ATTACKS LURE EMPLOYEES, BEAT MACHINE LEARNING TOOLS: Part III of the Evolving IKARUSdilapidated and Locky Ransomware Series If Your Copier / Scanner Calls, Don’t Answer (Until You Know It’s Really Them) THREAT RESEARCH LABS September 2017 Special Report (Part III of IKARUS/Locky Ransomware Series) A late September wave of new ransomware attacks has occurred, building on attacks first discovered by the Comodo Threat Intelligence Lab this summer. This newest campaign mimics your vendors and even your trusty office copier/scanner/printer from industry leader Konica Minolta. It uses social engineering to engage victims and is carefully designed to slip past machine learning algorithm-based tools from leading cybersecurity vendors, infect your machines, encrypt their data, and extract a bitcoin ransom. Ransom demand in September 18-21, 2017 attacks. This new, 3rd wave of related 2017 ransomware attacks uses a botnet of zombie computers (usually connected to networks through well-known ISPs) to coordinate a phishing attack which sends the emails to victims’ accounts. As with the 1st and 2nd waves, in early and late August 2017 respectively, this campaign utilizes a Locky ransomware payload. SPECIAL REPORT 2 THREAT RESEARCH LABS The larger of the two attacks in this 3rd Locky ransomware wave is presented as a scanned document emailed to you from your organization’s scanner/printer (but is actually from an outside hacker-controlled machine). Employees today scan original documents at the company scanner/printer and email them to themselves and others as a standard practice, so this malware-laden email looks quite innocent but is anything but harmless (and most definitely is not from your organization’s Konica Minolta copier/scanner). Email with subject “Message KM_C224e” looks like an email coming from the Konica Minolta (KM) C224e copier machine. As with real emailed scans, there is no text in the body of the email. One element of the sophistication here is that the hacker-sent email includes the scanner/ printer model number that belongs to the Konica Minolta C224e, one of the most popular models among business scanner/printers, commonly used in European, South American, North American, Asian, and other global markets. The Konica Minolta C224e. SPECIAL REPORT 3 THREAT RESEARCH LABS September 18, 2017: Debut of “.ykcol” and Other Tricks Both campaigns started on September 18, 2017, and appear to have effectively ended on September 21, 2017. These two attacks differ. One is imitating an email coming from your office copier /scanner machine (featuring the subject, “Message from KM_C224e”), while the second one is designed to appear as an email related to a question about the status of a vendor invoice (featuring the subject, “Status of invoice”). In contrast to the initial 2017 IKARUSdilapidated Locky campaign (which distributed malware with the “.diablo” extension and a Visual Basic Script (and has a “.vbs” extension)), and the 2nd later in August in which the “.lukitus” extension via JavaScript files were used, both September attacks have interesting variations aimed to not only fool users with social engineering, but also to fool security administrators and their machine learning algorithms and signature-based tools. The encrypted documents in both September attacks have a “.ykcol” extension and the “.vbs” files are distributed via email. This shows that malware authors are developing and changing methods to reach more users and bypass security approaches that use machine learning and pattern recognition. SPECIAL REPORT 4 THREAT RESEARCH LABS Global Threat Here is a heat map of the first new attack on September 18, 2017, featuring the “Message from KM_C224e” subject line followed by the source countries of the machines used in the botnet to send the emails: Country Sum - Count Of Emails Vietnam (VN) 26,985 Mexico (MX) 14,793 India (IN) 6,190 Indonesia (ID) 4,154 SPECIAL REPORT 5 THREAT RESEARCH LABS ISPs in general were co-opted heavily in this attack. This illustrates the sophistication of the attack as well as endpoint cyber-defense inadequacies and ineffective network and website security. Here are the leading range owners detected in the “Message from KM_C224e” attack: Range Owner Sum - Count Of Emails Vietnam Posts and Telecommunications (VNPT) 26,985 VDC 14,793 Lusacell 6,190 Cablemas Telecomunicaciones SA de CV 4,154 Turk Telekom 2,168 Cablevision SA de CV 2,207 The smaller of the 2 prongs in this September campaign sends phishing emails with the subject, “Status of invoice” and appears to be from a local vendor, even including a greeting of “Hello,” a polite request to view the attachment, a signature, and contact details from a fictitious vendor employee. Example of “Status of invoice” phishing email in September 2017 IKARUSdilapidated attack. SPECIAL REPORT 6 THREAT RESEARCH LABS When the attachment is clicked, it appears as a compressed file to be unpacked: Here you can see a sample of the scripting, which is quite different than that used in the attacks earlier in August 2017: SPECIAL REPORT 7 THREAT RESEARCH LABS Here is another view of the “ransom note” which then appears: The ransom demand range of .5 bitcoins to 1 bitcoin in both new cases mirrors that of the August attacks. On September 18, 2017 the value of 1 bitcoin equaled just over $4,000.00 US Dollars (and 3,467.00 Euros). This heat map illustrates detections of the September 18, 2017 attack featuring the “Status of invoice” subject line. The Americas, Europe, India, and Southeast Asia were impacted heavily, but Africa, Australia, and many islands were also hit by these attacks. SPECIAL REPORT 8 THREAT RESEARCH LABS The Scope The phishing and Trojan experts from the Comodo Threat Intelligence Lab (part of Comodo Threat Research Labs) detected and analyzed more than 110,000 instances of phishing emails at Comodo-protected endpoints within just the first three days of this September 2017 campaign. The attachments were read at Comodo-protected endpoints as “unknown files,” put into containment, and denied entry until they were analyzed by Comodo’s technology and, in this case, the lab’s human experts. The Lab’s analysis of emails sent in the “Message from KM_C224e” phishing campaign revealed this attack data: 19,886 different IP addresses were used from 139 different country code top-level domains. The “Status of invoice” attack utilized 12,367 different IP addresses from 142 country code domains. There are a total of 255 top level country code domains maintained by the Internet Assigned Numbers Authority (IANA), meaning both of these new attacks targeted over half of the nation states on earth. “These types of attacks utilize both botnets of servers and individuals’ PCs and new phishing techniques using social engineering for unsuspecting office workers and managers. This enables a very small team of hackers to infiltrate thousands of organizations and beat A.I. and machine learning-dependent endpoint protection tools, even those leading in Gartner’s recent Magic Quadrant.” said Fatih Orhan, head of the Comodo Threat Intelligence Lab and Comodo Threat Research Labs (CTRL). “Because the new ransomware appears as an unknown file, it takes a 100% ‘default deny’ security posture to block or contain it at the endpoint or network boundary; it also requires human eyes and analysis to ultimately determine what it is – in this case, new ransomware.” Attack Data – A Deeper Dive Diving into the data of the September 18-21, 2017 wave of attacks a bit deeper, the Appendices below includes more details on the machines used in the attacks. SPECIAL REPORT 9 THREAT RESEARCH LABS Appendix NOTE: To compare the details of these September 2017 attacks with the two IKARUSdilapidated campaigns of August 2017, see Part I and II of the Comodo Intelligence Lab Special Report entitled, “SPECIAL REPORT: AUGUST 2017 – IKARUSdilapidated: Locky Ransomware Family Back with a New Email Phishing Campaign Attack.” As the malware payload and ransom elements are the same in all the August and September attacks, please see the original Part I report to review those elements. These special reports from the Lab (as well as other reports and updates) are available to subscribers of Comodo Threat Intelligence Lab Updates. Subscribe for free at: comodo.com/lab THREAT RESEARCH LABS Appendix A: “Message KM_C224e” Attack Sum - Count Country Sum - Count Country Sum - Count Of Emails Of Emails Country Of Emails VN 26,985 MM 137 CD 20 MX 14,793 ZA 133 PT 20 IN 6,190 NG 127 GH 19 ID 4,154 BE 125 GQ 19 CO 4,063 SA 124 NA 18 BR 3,837 SG 121 NZ 18 TR 3,297 CR 113 IE 16 BO 1,615 HR 107 NO 16 AR 1,536 NP 104 ML 14 BD 1,123 AU 103 SI 14 PH 1,014 BA 97 CN 12 IR 986 MA 93 ST 12 TH 938 EG 75 WS 10 VE 774 LY 71 CW 8 IT 734 CA 62 HK 8 IL 622 PS 57 PG 8 PK 606 AO 55 CM 7 ES 565 NL 52 FJ 7 PL 543 ME 50 IQ 7 US 522 OM 49 LU 6 DO 511 CH 48 MT 6 EC 509 SV 48 BF 5 LA 455 AL 45 BW 5 MK 433 BT 44 JP 5 GT 413 JM 44 NC 5 KE 403 PY 43 RW 5 PE 390 UA 41 CZ 4 DE 349 AT 40 GE 4 ZW 307 SK 40 TT 4 MN 295 HU 38 AG 3 PA 283 UG 38 BQ 3 KH 282 SC 34 KZ 3 BG 268 MZ 33 MO 3 RS 263 DZ 31 MV 3 JO 242 KW 31 TN 3 GR 235 LB 30 UZ 3 MY 218 CY 29 AE 2 CL 215 MU 27 BN 2 RO 200 HT 26 MG 2 NI 191 AF 23 VU 2 HN 190 DK 23 LK 1 GB 174 KR 23 LV 1 ZM 174 TW 23 MH 1 CI 161 KY 21 MR 1 UY 157 LT 21 RE 1 FR 146 TZ 21 SE 1 XK 1 Total Result 85,419 SPECIAL REPORT 11 THREAT RESEARCH LABS Range Owner Sum - Count Range Owner Sum - Count Of Emails Of Emails Vietnam Posts and Telecommunications(VNPT) 18,824 Navega.com S.A.