Menu
“Onion” ransomware the next Cryptolocker: Kaspersky

“Onion” ransomware the next Cryptolocker: Kaspersky

Security vendor uncovers what could be the most technologically advanced encryptor thus far.

Kaspersky Lab has uncovered a type of encrypting ransomware that attempts to hide its malicious nature.

Dubbed “Onion,” because it uses the anonymous network Tor (the Onion Router) to make it hard to track, it encrypts user data and then demands ransom for decryption.

Kaspersky Lab senior malware analyst, Fedor Sinitsyn, said the malware demonstrates how Tor has become a proven tool and is being implemented into other types of malware.

“The Onion malware features technical improvements on previously seen cases where Tor functions were used in malicious campaigns,” he said.

This new malware, which uses a countdown mechanism to scare victims into paying for decryption in Bitcoins, is described by Sinitsyn as the potential successor to Cryptolocker.

Users affected by the ransomware are warned to pay up within a 72-hour deadline or all the files will be lost forever.

The new normal

The Onion transfers secret data and payment information with command and control servers within an anonymous network.

Sinitsyn said this kind of communication architecture existed in the past, though it was limited to banking malware families such as the Tor-enhance 64-bit ZeuS.

“Hiding the command and control servers in an anonymous Tor network complicates the search for the cybercriminals,” he said.

“The use of an unorthodox cryptographic scheme makes file decryption impossible, even if traffic is intercepted between the Trojan and the server.”

Sinitsyn said these characteristics add up to a “highly dangerous threat,” as well as one of the “most technologically advanced encryptors” in existence today.

Patrick Budmar covers consumer and enterprise technology breaking news for IDG Communications. Follow Patrick on Twitter at @patrick_budmar.

Read more: Beware of Wi-Fi when using E-tax: Bitdefender Read More:

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Tags zeussecurityCryptolockerransomwaremalwarekaspersky lab

Slideshows

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)

Unified communications company, Mitel, invited its top 30 partners in A/NZ to the Intercontinental Hotel in Sydney’s Double Bay. This is the first time the broader A/NZ Mitel channel community have been together since the company re-branding back in October 2014, post Aastra acquisition. ARN received an invite to join attendees for drinks and canapés on the hotel rooftop as Mitel and its partners toasted their recent success.

IN PICTURES: Mitel A/NZ Channel event Sydney (+23 photos)
IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

Twenty-one industry leaders came together with ARN staff for an Emerging Leaders Think Tank, held at The Bottle Shop in Sydney​. The aim of the planning session was to develop a compelling program for high potential leaders in the Australian ICT industry.​ Over two hours of strong debate a core line of thought evolved which will form the basis of the Emerging Leaders Forum to be held on May 17 in Sydney. Photos by MARIA STEFINA.

IN PICTURES: ARN Emerging Leaders Think Tank, Sydney (+40 photos)

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments