New Ransomware Infects by Using MS Word Macros
Researchers at Carbon Black have discovered a new form of ransomware that uses Microsoft Word macros to infect the target system. The PowerWare attack starts when a macro-enabled Word doc arrives, either through email or some other delivery method. When the victim opens the file, the macros open a PowerShell session, which downloads and executes the malicious code.
According to the blog post at the Carbon Black website, “Traditional ransomware variants typically install new malicious files on the system, which, in some instances, can be easier to detect. PowerWare asks PowerShell, a core utility of current Windows systems, to do the dirty work. By leveraging PowerShell, this ransomware attempts to avoid writing new files to disk and tries to blend in with more legitimate computer activity.”
The attack locks up the user's files and asks for a $500 ransom. If the ransom is left unpaid for two weeks, it doubles to $1000.
To avoid the attack, don't click on strange Word files, and be sure to disable default execution of Word macros. Initial implementations of the PowerWare attack are not as sophisticated as some ransomware variants. The blog post at Carbon Black says the attack “phones home with a plain-text protocol,” which means, if you have a packet capture tool, you can capture the domain and IP address of the attacker, then obtain the encryption key.
Related content
- Two New Malware Campaigns Found
- Fileless Phishing Attack Infects Windows Systems
-
Fight Windows ransomware with on-board tools
Ransomware defense involves two strategies: identifying attacks and slowing the attackers to mitigate their effects. -
Discover ransomware with PowerShell
Simple backup strategies cannot protect files encrypted by ransomware, because they can be affected as well. A PowerShell script can ensure that your files are okay before sending them to backup. -
Halting the ransomware blackmail wave
In the tsunami of ransomware infections this year, the Locky encryption trojan is a high-water mark. With a constant stream of novel attack patterns, this continually evolving pest makes life difficult for IT managers, users, and security vendors. Here's how to protect yourself.