Topic: CryptoWall V3 and V4 Protection for Intel Security Customers

[Pez]

CryptoWall V3 and V4 Protection for Intel Security Customers

Updated, November 6:

Since October 30, the release date of the Cyber Threat Alliance report on CryptoWall Version 3, we have spotted a new variant of the CryptoWall family. This variant has been labeled by many as Version 4, which is different in some ways from V3. This rapid update demonstrates how flexible the actors behind these campaigns are and the resources they have available to make changes within 24 hours. Intel Security detects this new version in our signatures as Ransom-CWall.a and Ransom-CWall.c.

As part of a joint investigation between the founding members of the Cyber Threat Alliance, we released a report that dissects the CryptoWall Version 3 family of ransomware. (For more on the malware’s aims, see this post.) Threat researchers from four companies, including Intel Security, shared indicators and knowledge around the inner workings of this malware and how it behaves from a network perspective.

For Intel Security customers, we have written detection for our endpoint products that classifies the ransomware as Ransom-Cwall. Besides our endpoint products, other products that consume McAfee Global Threat Intelligence feeds also detect the indicators of this ransomware family and protect our customers by blocking access to its control servers.

Indicators of associated URLs and IP addresses have been pushed into McAfee GTI and are updated daily  as we proactively monitor the movements of the campaigns that spread this form of ransomware.

While monitoring McAfee GTI statistics around this campaign, we saw starting in August a high number of detections in which the current control server sites were increasingly blocked and the number of visitors to these sites decreased:



As the CTA contributing members began to block these sites, we saw the adversaries behind the campaigns move to new sites for their control servers, which explains some spikes in September. Intel Security continues to monitor this ransomware threat and provide up to date information and detection in our products.

Original article: https://blogs.mcafee.com/mcafee-labs/cryptowall-v3-protection-intel-security-customers/