‘Ryuk Stealer’ Searches for and Steals Confidential Files from Government, Military, and Law Enforcement
The newest strain of this malware has added new keywords and filetypes to expand its ability to find files with content that can be turned into money through sale, extortion, or ransom.
The last thing a bad guy wants to do is to spend time trying to find where in your network they can make money. Instead, they leverage automation to do it for them. In the case of the Ryuk Stealer, the new strain discovers by the MalwareHunterTeam incorporates a number of automation improvements that make it relatively easy to search for and find data of value:
- Look for files with specific filetypes (including Office documents, PDFs, images, and C++ files)
- Check the filenames of all matching filetypes against 55 keywords
- Search through matching file content for 85 specific keywords
The terms used demonstrate the targeting of specific industries. For example “SWIFT” (Banking), “N-CSR” (Finance), “federal” (government), “investigation” (Law Enforcement), and “operation” (military).
This newly discovered attack represents what’s possible – work in a different industry? All that’s needed is to change the keywords utilized that are specific to your organization’s vertical and the bad guys have themselves another targeted attack campaign.
Educating users on the dangers of email and the web as primary attack vectors via Security Awareness Training helps to minimize the ability for an attacker leveraging such nasty malware as the Ryuk Stealer to infiltrate your network, find data of value, and exfiltrate it or hold it for ransom.
Gloss