Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

Multi-Purpose Ransomware Fuels DDoS Attacks

Cybercriminals using Ransomware appear to be leveraging infected machines for additional nefarious purposes, such as launching distributed denial of service (DDoS) attacks, researchers at Invincea warn.

Cybercriminals using Ransomware appear to be leveraging infected machines for additional nefarious purposes, such as launching distributed denial of service (DDoS) attacks, researchers at Invincea warn.

In addition to holding the victim’s data hostage until a ransom is paid, a newly spotted ransomware variant is also exploiting compromised machines as part of potential DDoS attacks, Invincea’s Ikenna Dike explains.

The researchers managed to tie the ransomware to the Cerber family and discovered that the malware was making changes to the computer’s screensaver, which allowed it to post a permanent ransom note on the victim’s screen. Additionally, the malware exhibited strange network behavior, calling out a large address range: from to

The actors behind this malware were using a weaponized Office document for distribution, while employing a fileless attack method. An RTF document arriving in the victim’s inbox prompted the user to allow macros to run in Microsoft Word to view the file content. However, once executed, the macros would spawn an elevated command shell on the host, meant to execute an encoded VBscript.

According to Invincea’s researcher, the malware’s code was obfuscated to hinder analysis attempts, but the functions and variables appeared computer generated. Pieces of code that resemble human readable functions were also observed, but the researcher believes that variables, integers, and comments in the code were actually added there to confuse analysts.

Dike also discovered that some of the functions in the code pointed to the creation of text files, while at the end, the code is exported to a .vbs file and then executed. After the script (which is called “3263.vbs” in this particular attack) is created and executed, it creates another malicious binary “3311.tmp,” which is believed to be the Cerber ransomware.

In addition to modifying the screensaver to display the ransom note and to calling the aforementioned large subnet, the malware creates a hexadecimal tmp file that subsequently launches the explorer.exe process. The process also creates a series of tmp files and writes them to the disk, and this sequence of events is supposedly related to a loop in the VBscript.

According to the researcher, there is a chance that the analyzed malware variant didn’t fully complete its process to deliver the final payload. If so, it means that, in addition to the already observed nefarious operations, the malware might perform other malicious activities on the victim’s machine if the binary can run to completion.

“The observed network traffic looks to be flooding the subnet with UDP packets over port 6892. By spoofing the source address, the host could direct all response traffic from the subnet to a targeted host, causing the host to be unresponsive,” the researcher concludes.

Earlier this week, Microsoft warned of improvements in macro malware, which now employs additional techniques meant to better hide malicious code. Highly popular in the 1990s, macro malware returned to focus last year. Earlier this year, Dridex and Locky, two malware families that spread through malicious documents, started using forms to hide malicious code.

Written By

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...


Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.