Member Avatar for IntegratedTweak
IntegratedTweak 16 Junior Poster in Training

CryptoWall 4.0 the newest ransomware to date is been spread by Angler Exploit Kits. A new drive-by download campaign is to blame for this attack.

Heimdal was the first to discover the malware nearly one month ago. It's also more stealthier than previous versions and also a lot stronger. This time the message is different and more filenames had been added to the list. Also users have to fork out $700 for the decryption key which makes it a hefty price to pay.

Firstly the Pony Information Stealer scrapes the computer of usernames and passwords by scouring the victims computer. Then it sends the information back to the Command & Control Server. The victim is then redirected to a different page which then drops the Angler Exploit Kit. The exploit kit then finds vulnerabilities in the system and then injects the malware into the system.

Over the first 24 hours alone Heimdal had found over 200 domains. The domains that were found originated in an hosting environment from Ukraine. And has thusfar hit computers in Denmark pretty hard where 100 sites were injected with the infamous malware. At the moment Security Experts say that it's best to not pay the ransom as the infection will return. It's important to have daily backups along with a good security program and to also have Windows Updates turned on.

Edited by happygeek because: error
  • 1 Contributor
  • 0 Replies
  • 395 Views

Dani AI

Generated

Good summary by — a few concise, practical additions that readers arriving later will find immediately useful.

Key detection artefacts to look for: ransom notes named HELP_YOUR_FILES.*, suddenly scrambled filenames (random-looking names/extensions), and the malware running from %APPDATA% with Run-key persistence; CryptoWall 4.0 also attempts to remove Shadow Volume Copies / disable System Restore to frustrate recovery. These behaviours and the EK-driven delivery chain have been documented in vendor writeups and technical dissections. (tripwire.com)

If investigating a suspected compromise, capture an image (disk + memory) first, then search system/process logs for signs of VSS/vssadmin usage or unexpected svchost.exe/explorer.exe injections. A quick detection example for SIEM: find process-creation events where ProcessName is vssadmin.exe and CommandLine contains delete shadows (store those hits as IOCs). Also scan webserver/FTP/SSH logs for new admin credentials or unexpected file uploads — the campaign’s distribution relied on compromised sites as staging. (malwarebytes.com)

Immediate containment checklist:

  • Isolate infected hosts from the network.
  • Acquire forensics (disk/memory image) before making changes.
  • Preserve ransom notes and one encrypted sample offline.
  • Rotate/reset all potentially exposed credentials (CMS, FTP, SSH, email).
  • Block known EK landing domains at proxy/firewall and disable legacy plugins (Flash/Java) until patched.
  • Report the incident to law enforcement / IC3 and follow their guidance. (bleepingcomputer.com)

Longer-term: maintain tested, offline backups and practice restores; enforce least privilege, patch management, script-blocking (browser) and EDR monitoring for process injections. Treat filename-encrypting ransomware like CryptoWall 4.0 as a business-continuity problem — the technical controls help, but resilience (recoverable backups + response playbook) is the decisive factor. (bitdefender.com)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.