Security researchers observed a new attack campaign in which the Viro botnet infects devices with ransomware and then uses those compromised machines to infect more victims.

Once downloaded, according to Trend Micro, Viro quickly generates encryption and decryption keys with a random number generator after scanning the infected device for the right registry. Interestingly, although the botnet is aimed primarily at Americans, the attack displays a ransom note in French after successfully encrypting files using RSA.

Viro first made headlines when it was discovered in the wild in late 2017.

Viro’s Expanded Spamming and Keylogging Capabilities

While early examples of ransomware simply held data hostage until victims paid up, the recent Viro attacks involve additional capabilities, such as penetrating users’ email systems and contact lists to spam other potential victims.

Its keylogging capabilities, meanwhile, allow cybercriminals to harvest other data, which was then sent back to a command-and-control (C&C) server to download additional malware or other files. The researchers speculated that Viro may be based on a variant of Locky, which made headlines throughout 2017.

On the plus side, the researchers noted that Viro’s C&C server had been taken down since they first observed the attacks — meaning it will no longer be able to encrypt files even if it lands on a victim’s machine.

How to Avoid Botnet-Borne Ransomware Attacks

Ransomware attacks like Viro often start when someone innocently clicks on an email attachment that triggers the download process. IBM experts advise security teams to restrict the execution of programs from temporary folders where malware files commonly reside. This is usually just a matter of leveraging common Software Restriction Policies (SRPs) and Group Policy Objects (GPOs) that are already available within security tools, which would block attempts by cybercriminals to copy malicious payloads from a temporary folder.

Threat actors may also aim ransomware at AppData or Local AppData folders. Organizations can keep ransomware at bay by turning off the ability to launch executables in these areas.

Source: Trend Micro