For quite some time we have been publishing about the malicious software CryptoWall or Crypto-Wall. SecNews.gr readers already know that it is another ransomware that encrypts victims' data, demanding ransom for its recovery.
Today the Cyber Crime Directorate issued a notice about this malware.
We quote it below:
The Cybercrime Directorate informs citizens about the malicious software "Crypto-Wall"
The Crypto-Wall malware aims to demand payment of a ransom in order to unlock – decrypt digital files and data on the computers of ordinary users or corporate networks.
The malicious software of the “crypto-malware” family can affect all versions of operating systems and spread, mainly, via email messages
In recent days the phenomenon has been on the rise with many reports of corporate network infection incidents
The Hellenic Police's Cybercrime Directorate informs citizens about the continued appearance in our country of the malicious software "CryptoWall".
This software is classified among digital threats of the Crypto-Malware type, and it can affect all versions of operating systems.
Specifically, the malicious software Crypto-Wall infects a computer in two main ways, via infected email messages that contain malicious attachments and via unsafe or compromised websites.
More specifically, after its installation on the operating system, using an advanced encryption system, it encrypts - locks all digital files and data (various file types, including: *.doc, *.docx, *.xls, *.ppt, *.psd, *.pdf, *.eps, *.ai, *.cdr, *.jpg, etc.) that are stored on the computer of the user infected by the virus, while in order to unlock the files, a sum of money (ransom) must be paid, otherwise they become inaccessible to the user.
The software has been released in its 3rdversion since January 2015 worldwide and it is noted that for both the current and previous versions – while there are solutions available for its removal – it is not possible to decrypt files, due to the very strong encryption (2048-bit / 4096-bitRSAkey) used.
This malware (Crypto-Wall) also has the ability to self-propagate through the local network and encrypt the files of any system it gains access to. This capability makes it extremely dangerous in corporate networks where propagation can be rapid.
The payment of the sum is made, via an anonymous browsing program, using the digital currency type bitcoin (BTC), following a message that appears to the user, with indications and instructions for the payment.
Internet users, especially corporate network administrators, are urged not to pay the demanded money, in order to discourage such illegal practices and to prevent the phenomenon from spreading, and they must be especially careful and take digital protection and security measures to avoid infection by malicious software.
Specifically:
- Users who receive email messages from unknown senders or unknown origins are urged not to open the links and not to download the attached files contained in them, for which they do not know with certainty the sender and the content of the attached file.
- Furthermore, users should be extremely suspicious of email messages that appear to be from a service or company that is unknown to them,
- It is recommended to type in web page addresses (URLs) into the browser,instead of using hyperlinks (links),
- genuine software programs should be used and updated regularly (updates), and there should always be an up-to-date protection program (anti-virus) for the PC,
- to check and always keep their operating system version updated,
- to create backup copies of filesatregular intervals, on an external storage medium, so that in the event of an "attack" by malicious software, it is possible to restore them,
- Particular attention to regular and secure backups is recommended to administrators of corporate networks, as backups are the only way to restore files in their entirety.
It is reminded that citizens can contact the Cybercrime Investigation Department of the Headquarters of the Hellenic Police for relevant incidents or for providing clarifications – advice, at the following contact details:
- By phone at: 11188
- By sending an e-mail to: ccu@cybercrimeunit.gov.gr
- Through the application for smartphones : CYBERKID
- Twitter:@CyberAlertGr
