New Ransomware Attacks Endpoint Defenses

AVCrypt tries to disable anti-malware software before it can be detected and removed.

A newly discovered ransomware variant attempts to remove any anti-malware protection in place on a victims computer before it begins its nefarious work.
A group of researchers that includes
Lawrence Abrams
(of bleepingcomputer.com),
MalwareHunterTeam
, and
Michael Gillespie
discovered the malware and reported it in a post on BleepingComputer. The malware, which the group of analysts and researchers is calling AVCrypt, first tries to identify and remove a number of Windows services that are required for two specific anti-virus packages, Windows Defender and Malwarebytes, to operate successfully.
Abrams said
in his post
that AVCrypt seems at best incomplete because of major missing pieces. While it does contact a command and control server and encrypt files, it doesnt actually include any ransom instructions or provisions for decryption.
In a
Twitter conversation about the ransomware
, several participants point out that other types of malware have been able to disable particular antivirus packages, but that this is new behavior for ransomware. Its also noted that AVCrypt specifically targets Malwarebytes and Windows Defender. Defender is the default antivirus package from Microsoft thats typically activated if the user decides not to install other AV software.
MalwareHunterTeam also pointed out in the Twitter exchange that AVCrypt will abort a shutdown sequence command in an attempt to prevent the user from staying safe by pulling the plug on a machine. The combination of behaviors could make a number of the standard processes for an emergency recovery unworkable.
While the specific ransomware variant discussed in the article is new, there are significant similarities to other malware code seen previously. In a Twitter discussion with Michael Gillespie, Microsofts
Windows Defender Security Intelligence
tweeted, #WindowsDefenderAV blocked this #ransomware at the onset using proactive cloud-based protection. Were seeing very limited instances of this ransomware, it does look like its in development. We detect this new threat as Ransom:Win32/Pactelung.A.
It seems that the curtain has been pulled back on a very new, very immature ransomware variant before it could be released into the wild in its finished form. The delivery mechanisms for AVCrypt appear to be the standard methods seen in other ransomware, including malicious spam, drive-by URLs, and pirated software. For now, it appears that stringent applications of existing protection should protect organizations against AVCrypt.
Related Content:
GandCrab Ransomware Goes Agile
7 Ways to Protect Against Cryptomining Attacks
What Happens When You Hold Robots for Ransom?
Microsoft Report: Cybersecuritys Top 3 Threats Intertwine
Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the
security track here
. Register with Promo Code DR200 and save $200.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Ransomware Attacks Endpoint Defenses