Imagining The Ransomware Of The Future
L33tdawg: The Talos team will be at #HITB2016AMS in May talking about Exploit Kits - Hunting the Hunters
Ransomware that can encrypt and lock 800 of your organization's servers, 3,200 workstations, and the vast majority of your data...in one hour flat. That's the nightmare that researchers at Cisco Talos Labs described in a report today: a self-propagating, stealthy, modular ransomware that can move laterally across internal networks and cross air-gapped systems.
In addition to the standard core ransomware functionality, Cisco Talos' hypothesized "King's Ransom framework" has a variety of modules for both stealth and propagation.
To avoid detection, "king's ransom" would have a rate limiter module -- to prevent the code from eating up too many system resources and therefore attracting the user's unwanted attention. In this framework, the ransomware would also eschew the traditional command-and-control infrastructure; it would instead transmit a beacon, containing global unique IDs (GUIDs), to a C2 domain via common protocols like HTTP or DNS. This domain could then collect these GUIDs, and use them to monitor and manage stats about infection rates.
