Ransomware is not a new term. In fact, Cryptolocker and others like it are becoming more of a “household term” these days. Now those criminals have taken the former ransomware that typically encrypts your personal files and have applied it to Linux-based servers to encrypt entire web pages and even websites.
It is being termed Linux.Encoder.1 by some and is nearly undetectable by anti-malware products so far. This one will encrypt the site and demand a ransom to get the files back, as is the usual routine. Unfortunately, when one victim did pay the ransom, the files were not returned to their former state. It cost this person approximately $420 in Bitcoins.
The lesson here is to always keep current backups on any important systems so that should malware strike, those all-important files can be restored with little trouble and without paying a criminal for a key that likely won’t resolve the issue. Also, make sure to keep anti-malware software active and updated on all systems. Even if certain ones are not detected, the majority are and this will prevent a lot of frustration on a day-to-day basis.
Because some of the nastiest malware requires the system to be run in administrator mode, it is generally advised to not do this. In this case, this indeed appears to have been the situation.
In addition, this particular malware took advantage of an unpatched vulnerability in the Linux server. The patch for an issue with the Magneto e-commerce platform had been available since April, but was never applied. So, if you are in charge of any networks, make sure you don’t fall into the group of administrators that does not put patching at the top of the priority list. A regular patch schedule should be in place and followed and critical and security patches should be applied as soon as they are available.
The company Bitdefender has stated it found a flaw in this particular malware and was able to decrypt the files without any codes. However, this is far from the normal case.
This malware doesn’t limit itself to encrypting HTML, PHP, and JavaScript files. It goes further and jumbles SQL databases, audio and video files, and more to wreak even more havoc. Remember to never pay a ransom to get any decryption keys. There is no guarantee that you will ever get them and even if you do, as the victim mentioned earlier found out, it is with no certainty that they will actually work.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
