Ransomware attacks at the rise

An increase in ‘ransomware' attacks was detected during the last few months.

In line with predictions made by SC Magazine in its wait for 2012 trends, PandaLabs said it had seen a rise within the attacks, with the primary posing as a warning from Microsoft that it had detected a pirated version of Windows and the user needed to pay a superb or be reported to the police.

Luis Corrons, technical director of PandaLabs, said other messages speculated to be from law enforcement agencies: “While we're used to seeing the sort of fake message in English, as a consequence the attacks are localised. We've seen English, German, Spanish and Dutch [messages], counting on the targeted country. All the attacks are targeting some European country, so it looks as if they're related and the identical cyber criminal gang may be behind them.”

Once their computer is infected, the user is informed that they've accessed illegal material (consisting of child pornography) and that the pc would be locked to avoid further abuse; to unlock their computer, they need to pay a 'fine' of "100.

“The worst thing for the user is that it actually blocks the pc, so it isn't easy to take away. To do it, restart the pc in safe mode and run a scan with an anti-virus solution that's in a position to detect it,” Corrons said.

Speaking to SC Magazine, Corrons said such infections are frequently distributed using different exploits via drive-by-download techniques, in preference to by targeting people.

“However, if you are infected the file connects to a definite URL and, in accordance with the victim's IP address, it is going to retrieve the localised version of the message if you want to appear within the computer,” he said.

Asked how best to bypass or take care of infection, Corrons recommended having software updated, starting with Java and Acrobat Reader, and using anti-virus software.

He said: “There are some variants that disable the choice to begin Windows in safe mode, so if so you need to run a scan using among the typical rescue disks that any major anti-virus company has.”