Malware 'Crysis': New Strain Combines Multiple Threats, Platforms
NEWS ANALYSIS: The latest release of Crysis malware combines ransomware with a data breach, and then spreads on its own.In some ways, the latest variation of Crysis (or Crisis, depending on whom you ask) malware either provides something for everyone, or it's a nightmare scenario, depending on how you look at it. When Crysis first came to light, it was a fairly typical, if annoying, form of ransomware. It would encrypt some files and then demand ransom, ostensibly offering to decrypt those files if you paid. Things have changed. Following a series of monthly updates, this malware is now able to exfiltrate critical files and user information, gain administrator rights to the computer it's infecting and take over as an admin user. It also doesn't matter if the computer is a PC or a Mac because Crysis can infect either platform, and once inside a network, it can also attack virtual machines and any server visible to the computer it's on. Complicating matters, the Crysis malware that's out now doesn't attack any OS vulnerabilities. According to a study by Symantec, the malware is inserted using a Java applet dropper. Normally, Java applets can't access machine resources, but in this case, the attack includes sophisticated social engineering intended to get the machine's user to allow it to have full access to the system. Once installed on a machine, the Crysis malware can use a variety of self-running files to spread to other machines, including Windows Phone devices and other computers on the same network. Right now, the malware can only attack certain virtual machines (VMs) from VMware, but not other VMs, but there's no reason this can't be extended.
Adding to the misery, the Crysis malware also copies the admin login information for any computer it attacks to its command-and-control server, allowing that machine and others to be attacked as long as the credentials haven't been changed. And if that's not enough, the bad guys have now raised their ransoms from a few hundred bucks to levels well in excess of $20,000. And, of course, there's no assurance that they will actually deliver the decryption keys or remove the malware.