The Anti-virus Times

Friday, April 14, 2017

Sometimes it seems like the world has turned upside down. Lately, positive reviews (even from some IT security experts) have been appearing on the World Wide Web about services launched by criminals who distribute encryption ransomware. They praise the helpful support, flexible rates, the opportunity to test how well their corrupted files can be decrypted, etc. Given that few corrupted files are actually recoverable, feedback of this kind will help users sleep soundly and with a clear conscience refuse to spend anything extra on anti-virus software, user education, or employee training. After all, the ransom amount (as they say) is quite reasonable and the probability of an infection occurring is far from 100%, so it's easier to pay once and relax.

The problem is that few attackers are competent enough to encrypt files and be able to recover them later. And not all of them can (and want) to invest into high-quality support. Moreover, why go to such lengths if users are willing to pay anyway?

Interestingly, the criminals don’t just make ransom demands—they also try to blackmail users.

The experts stress the fact that this new ransomware uses features that enable it to avoid detection by anti-viruses. "Thanks to good code obfuscation and the use of Java Reflection, the ransomware can evade anti-viruses. In addition, the four-hour idle period enables it to avoid detection by anti-viruses that rely upon dynamic analysis".