October 13, 2016 By Larry Loeb 2 min read

The DXXD ransomware, first observed in September, made a strong return to the malware scene with a different encryption method and some new threats. According to Bleeping Computer, the previous version of the ransomware had been effectively skunked by the availability of a decryptor tool, leading to this new iteration.

The Ransom Note

DXXD is unusual in how it displays its ransom note. Instead of using a displayed file, DXXD changes a Windows Registry setting so that users are presented a fake legal notice upon logging in. This notice is also shown to any user who logs in after infection.

The message explains that the machine has been “attacked by hackers” and prompts users to contact experts at given email addresses “for more informations [sic] and recommendations.” This is how the ransomware gets paid — through emails to the dropboxes.

The DXXD developers appear to have deliberately displayed the message during the login process to create the illusion that the message comes from the manufacturer.

But the malware also has another nasty trick up its sleeve: It attempts to encrypt any network shares, whether they are mapped or not. The Locky family of ransomware has encrypted network shares in the past, but it is not a common ransomware tactic.

Mysterious Methods

Just how the malware author pulls it all off is somewhat unknown. While the actor has confessed to using a zero-day exploit on various web posts, others don’t buy it.

According to Bleeping Computer, the author may be compromising servers using remote desktop services and brute-forcing passwords. Affected users should reset their passwords immediately.

SecurityWeek, meanwhile, wisely noted that that paying the ransom is not a good solution in the event of an attack. There is no guarantee the data will be recovered even if the ransom is paid.

Mitigating DXXD Ransomware

To mitigate attacks like DXXD ransomware, the usual best practices apply. Be sure to constantly back up files, keep software up to date, use a reputable anti-malware product and avoid attachments or links that come from unknown sources. Disabling Remote Desktop Protocol (RDP) and all the files that can run from AppData/LocalAppData folders may help in this specific situation as well.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today