Cryptobit Spreading Via Large Spam Campaign

Malware doesn’t take a summer vacation and neither should you take a break from making sure it doesn’t infringe upon your valuable time. A new strain, named Cryptobit is being pushed out through a large spam campaign called Realstatistic. It has made its way into thousands of websites built on Joomla! and WordPress.

The operative term here is “spam.” This means thousands and thousands of email messages are being sent out to recipients; many of whom the spammers hope will open them and click on a link or attachment that sets loose the Neutrino Exploit kit. This kit takes advantage of vulnerabilities in PDF readers or Flash software. We will get back to those vulnerabilities in a moment.

First, watch for email messages that arrive in your in box with links or attachments that are unexpected. These are usually the dangerous ones that unleash malware of some type. In this case, it is ransomware and which version varies. If you are not completely, without a doubt certain that a link or attachment is safe, don’t click it.

As for the vulnerabilities, security company Surcuri suspects there are patches available, but they were just not applied. They claim that 60% of sites they tested are running an outdated version of Joomla! or WordPress. So always make sure your software and firmware is running the most updated versions and all the patches are applied promptly. Adobe Flash is notorious for vulnerabilities and cyber criminals take advantage of them whenever possible.

What is common with all of the infections (2,000 of those using Surcuri alone scans) is that the ransomware urges the victims to contact the hostage-takers to restore files, but the ransom notes do not give information on how to contact them or in what denomination or amount to pay. This could mean it was let loose before it was ready for prime time and that the cyber criminals are still working on it.  In fact, eight different samples of Cryptobit had been going around over a 10-day period. Some researchers have said they saw Neutrino spreading banking malware as well, indicating it is switching up the type of malware being distributed.

This is the screen you will see if you happen to run the ransomware on your PC: