The DXXD ransomware, first observed in September, made a strong return to the malware scene with a different encryption method and some new threats. According to Bleeping Computer, the previous version of the ransomware had been effectively skunked by the availability of a decryptor tool, leading to this new iteration.

The Ransom Note

DXXD is unusual in how it displays its ransom note. Instead of using a displayed file, DXXD changes a Windows Registry setting so that users are presented a fake legal notice upon logging in. This notice is also shown to any user who logs in after infection.

The message explains that the machine has been “attacked by hackers” and prompts users to contact experts at given email addresses “for more informations [sic] and recommendations.” This is how the ransomware gets paid — through emails to the dropboxes.

The DXXD developers appear to have deliberately displayed the message during the login process to create the illusion that the message comes from the manufacturer.

But the malware also has another nasty trick up its sleeve: It attempts to encrypt any network shares, whether they are mapped or not. The Locky family of ransomware has encrypted network shares in the past, but it is not a common ransomware tactic.

Mysterious Methods

Just how the malware author pulls it all off is somewhat unknown. While the actor has confessed to using a zero-day exploit on various web posts, others don’t buy it.

According to Bleeping Computer, the author may be compromising servers using remote desktop services and brute-forcing passwords. Affected users should reset their passwords immediately.

SecurityWeek, meanwhile, wisely noted that that paying the ransom is not a good solution in the event of an attack. There is no guarantee the data will be recovered even if the ransom is paid.

Mitigating DXXD Ransomware

To mitigate attacks like DXXD ransomware, the usual best practices apply. Be sure to constantly back up files, keep software up to date, use a reputable anti-malware product and avoid attachments or links that come from unknown sources. Disabling Remote Desktop Protocol (RDP) and all the files that can run from AppData/LocalAppData folders may help in this specific situation as well.