Hackers caused disruption to a Locky campaign after they breached one of the attackers’ server and replaced the real ransomware with a harmless file containing the string “Stupid Locky.”
According to Avira researcher Sven Carlsen, the attack started with a spam email designed to trick recipients into opening an attachment by informing them of an unpaid fine.
The attached file is actually a malware downloader configured to fetch the Locky ransomware from a server whose location is determined based on a domain generation algorithm (DGA). The downloader then executes the file.
However, in the attack analyzed by Avira, the downloader did not fetch Locky and instead it downloaded a 12Kb executable containing the message “STUPID LOCKY.” Since the file did not have a valid structure, the downloader failed to execute it, resulting in an error message being displayed.
Carlsen believes someone, most likely a white hat hacker, breached the cybercriminals’ command and control (C&C) server and replaced the real Locky executable with a dummy file.
This wouldn’t be the first time white hats have attempted to disrupt a malware campaign. In February, Avira reported that someone hacked one of the distribution channels of the Dridex botnet and replaced the banking Trojan with a clean copy of an Avira antivirus application.
“I don’t believe that cybercriminals themselves would have initiated this operation because of the potential damage to their reputation and income stream. I also wouldn’t say that ‘Locky is dead’ after this operation,” Carlsen said. “As we know, they are still active and understand their ‘business’ very well. But after the examples of Dridex and now Locky, it shows that even cybercriminals, masters of camouflage, are also vulnerable.”
Locky is designed to encrypt more than 160 different file types on infected systems and victims are asked to pay between $220 and $880 to recover their files. A report published this week by Cloudmark shows that, in the first quarter of 2016, the US, Italy, and the UK saw the most consistent and prolonged attacks. Japan and Norway were also heavily targeted for brief periods of time.
Researchers noticed recently that the Dridex botnet has also been used to deliver Locky ransomware.