Locky ransomware continues to bypass security
Hackers looking to plant Locky ransomware on victim's systems are using XOR obfuscation and reversing the bytes on the payloads to evade detection by network security tools.
Researchers at the firm recently observed a Locky distributor embarking on further efforts to make their ransomware more elusive and effective.
"These campaigns continue to demonstrate the trend of threat actors shifting delivery mechanisms and adding new layers of obfuscation and evasion to bypass security defences. In the example above, the initial payload was actually the RockLoader malware loader which then attempted to install Locky from a sophisticated command and control (C&C) architecture," researchers at Proofpoint said in a blog post.
XOR obfuscation disguises the code of the malicious ransomware as something that makes looks like it was part of the original binary code.
"Last week, though, we observed one Locky actor (affiliate ID 1) begin using XOR obfuscation and reversing the bytes on the payloads to evade detection by network security tools," said the researchers.
This technique has been proven to be fast and effective, which has made it a popular choice among threat actors.
"While this type of obfuscation can be particularly effective against network security products that primarily scan executables entering the network, they can also be used for sandbox evasion," they said.
The researchers recommended that users have layered forms of security to counteract the techniques of Locky, especially since it is harder than ever to be detected.
Four strategies for building a hybrid workplace that works
All indications are that the future of work is hybrid, if it's not here alreadyFree webinar
The digital marketer’s guide to contextual insights and trends
How to use contextual intelligence to uncover new insights and inform strategiesFree Download
Ransomware and Microsoft 365 for business
What you need to know about reducing ransomware riskFree Download
Building a modern strategy for analytics and machine learning success
Turning into business valueFree Download