{"id":33222,"date":"2020-03-18T03:13:00","date_gmt":"2020-03-18T07:13:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=33222"},"modified":"2020-03-18T03:13:00","modified_gmt":"2020-03-18T07:13:00","slug":"beware-of-this-new-windows-10-ransomware-threat-hiding-in-plain-sight","status":"publish","type":"post","link":"https:\/\/blog.cyberconservices.com\/index.php\/2020\/03\/18\/beware-of-this-new-windows-10-ransomware-threat-hiding-in-plain-sight\/","title":{"rendered":"Beware Of This New Windows 10 Ransomware Threat Hiding In Plain Sight"},"content":{"rendered":"\n

By Davey Winder<\/a> – Windows users have become accustomed to warnings related to system updates, like the recent report of a threat campaign that specifically\u00a0targets newly updated Windows 10 systems<\/a>, for example. Now, as picked up by the folk over at\u00a0Bleeping Computer<\/a>, it seems that threat actors are using Windows Explorer as part of their ransomware attack process.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

A strain of the Mailto (NetWalker) ransomware can inject malicious code right into Windows Explorer, researchers at security solutions company Quick Heal discovered. By using a technique of “process hollowing” to achieve this process code injection, the ransomware actors hope to evade detection. Process hollowing is a defense evasion technique, unmapping memory of a suspended state process and replacing it with malicious code, that is effective against whitelisting and signature-based detection. Except that the researchers found that instead of creating the process in suspended mode, the NetWalker actors are using debug mode instead. All of which is bad news, as NetWalker is as nasty as it is sophisticated, targeting both home and business Windows users alike. After the ransomware runs its encryption routines, “explorer.exe kills the parent process and deletes the original sample,” the file that has been dropped as well the RUN entry, the researchers said<\/a>, “eradicating the traces of its existence.”<\/p>\n\n\n\n

The recently published FBI Internet Crime Complaint Center (IC3) “Internet Crime Report<\/a>” revealed that reported cybercrime had cost individuals and businesses a staggering $3.5 billion (\u00a32.7 billion) in 2019. The FBI has been warning anyone who will listen about\u00a0the high-impact nature of ransomware<\/a>\u00a0for months now, yet still we see incidents such as the City of New Orleans which\u00a0declared a state of emergency<\/a>\u00a0following such an attack and London-based\u00a0global foreign currency exchange Travelex suffering massive business disruption<\/a>\u00a0courtesy of ransomware actors. That FBI IC3 report showed that ransomware losses were up from $2.4 million (\u00a31.85 million) in 2016 to $8.9 million (\u00a36.8 million) last year. Read On:<\/a><\/p>\n\n\n\n