A 13-year-old security threat known as Dharma ransomware is spreading through a variety of distribution methods, leading to a 148 percent increase in detections over a two-month period.
According to a blog post from investigators at Malwarebytes Labs, attackers are primarily aiming the malicious threat — which is also known as CrySIS — at businesses with computers running Microsoft’s Windows operating system. Once they gain access to the target device, threat actors are able to wipe out Windows Restore points, capture the computer’s name and send its details to a server they control. Dharma ransomware then threatens to hold any stolen files hostage until the victim pays an amount of bitcoin to a set of email addresses.
Inside Dharma Ransomware’s Attack Vectors
Like many similar threats, Dharma is utilized by cybercriminals who often trick unsuspecting businesses into clicking on malicious links in email messages. Even sophisticated computer users could, for instance, assume that a message attachment isn’t executable because it uses double file extensions, which can make it seem harmless if Windows is set to default mode.
More often, threat actors are going beyond traditional phishing campaigns. As researchers have noted, attackers can attempt to brute-force the remote desktop protocol (RDP) in Windows port 3389 and then manually attack with ransomware.
Another popular method of attack is to disguise Dharma/CrySIS as a component of a legitimate software application, such as an antivirus detection tool. Mistaking the threat for installation files, victims may then download and execute the software themselves.
Those who face these tactics will find that the ransomware uses RSA-1024 and AES-256, standard encryption methods that are particularly difficult to crack. Sometimes, the cybercriminals try to extend their reach even further by using admin rights to find more files they can hold hostage.
Lock Out Dharma (Before It Locks You Out)
Given the number of approaches attackers are using and the ease with which Dharma can be spread, security teams should look for the right mix of tools and policies to limit their risk of exposure to ransomware.
According to IBM experts, security professionals should establish a policy that prohibits attachments with executables and also take advantage of endpoint detection tools that raise the alarm if ransomware makes its way into the organization.