Criminals reused an attack from 2008 to hit the Internet with a huge wave of ransomware in recent weeks, a security company has reported.
In the space of only two days, February 8 and 9, the HTML/Goldun.AXT campaign detected by Fortinet accounted for more than half the total malware detected for February, which gives some indication of its unusual scale.
The attack itself takes the form of a spam e-mail with an attachment, report.zip, which if clicked automatically downloads a rogue antivirus product called Security Tool. It is also being distributed using manipulated search engine optimization (SEO) on Google and other providers.
Such scams have been common on the Internet for more than a year, but this particular one features a more recently-evolved sting in the tail.
The product doesn’t just ask the infected user to buy a useless license in the mode of scareware, it locks applications and data on the PC, offering access only when a payment has been made through the single functioning application left, Internet Explorer.
What’s new, then, is that old-style scareware has turned into a default ransom-oriented approach.
The former assumes that users won’t know they are being scammed, while the latter assumes they will but won’t know what to do about it.
The technique is slowly becoming more common — see the Vundo attack of a year ago — but what is also different is the size of this attack, one of the largest ever seen by Fortinet for a single malware campaign.
Fortinet notes that Security Tool is really a reheat of an old campaign from November 2008, which pushed the notorious rogue antivirus product Total Security as a way of infecting users with a keylogging Trojan.
“This is a great example of how tried and true attack techniques/social engineering can be recycled into future attacks,” says Fortinet’s analysis.
According to Fortinet, the “engine” pushing the spike in ransom-based malware is believed to be the highly-resilient Cutwail/Pushdo botnet, the same spam and DDoS system behind a number of campaigns in the last three years including the recent pestering of PayPal and Twitter sites.
Business attacks blitz
The wave of malware attacks over the past few months have taken their toll on businesses as well.
As many as 75 per cent of businesses polled by security firm Cupertino, Calif.-based Symantec Corp. in January said they had experienced cyber attacks over the past 12 months.
The findings of this survey have been published in Symantec’s State of Enterprise Security 2010 report. The report polled 2,100 CIOs, CSOs and senior IT managers from small, mid-sized and large enterprises in 27 countries, including Canada.
Forty-one per cent of those polled said the attacks they experienced were somewhat/highly effective.
And the report suggests the situation is worsening. Fifty-seven per cent reported somewhat to extremely swift growth of attacks and reported “external malicious attacks” as being the fastest growing type.
A director of IT in a 35,000-person manufacturing firm said they experience as many as eight to nine attacks a week. “Everyday we see new viruses, new spyware and new backdoors,” said an MIS director at a mid-sized organization. “It’s beyond crazy.”
Every single one of the organizations surveyed had experienced varying degrees of losses as a result of these attacks.
Some common types of losses included:
- Theft of customer information that’s personally identifiable
- Environment downtime
- Theft of intellectual property
- Theft of customer credit card data
In 92 per cent of the cases, these losses carried “serious costs” to the organization. The most common consequences were: lost productivity, lost revenue and loss of customer trust.
In dollar terms, these losses collectively cost companies polled an average of $2 million annually. For the larger enterprises the cost was even higher — $2.8 million annually.
An IT operations manager for a 1,500 employee auto dealership consortium estimated the loss of confidential customer information – such as social security numbers or credit cards – at $11,000 per name.
“But the biggest cost is a ruined reputation,” the manager said. “Who wants to do business with a company that cannot protect their customers’ information?”