The Central government has issued a ‘Virus Alert’ via The Indian Computer Emergency Response Team (CERT-In) as a new type of ransomware has been found spreading through email.
The ransomware is targeting Windows computers and once the payload is delivered it locks the PC remotely and asks for money from the user to open it again.
CERT-In in its latest advisory warned about the ransomware called Diavol. According to the advisory, the ransomware is compiled with Microsoft Visual C/C++ Compiler. “It is encrypting files using user-mode Asynchronous Procedure Calls (APCs) with an asymmetric encryption algorithm,” it said.
According to CERT-In, the Diavol malware has been spreading via email, which includes a link to OneDrive. The OneDrive link directs the user to download a zipped file which includes an ISO file containing a LNK file and a DLL. Once opened on the users system, the LNK file masqueraded as a Document entices the user to click/open it. Once the user executes the LNK file, the malware infection will be initiated.
Diavol damage
After the Diavol malware infects a PC, it carries out pre-processing on the victim system including registering the victim device with a remote server, terminating running processes, finding local drives and files in the system to encrypt, and preventing recovery by deleting shadow copies. Then, the files are locked and desktop wallpaper is changed with a ransom message.
When executing on a compromised machine, the ransomware extracts the code from the images’ PE resource section and loads it within a buffer with execution permissions, according to CERT-In
How to stay safe from Diavol
In order to stay safe from this ransomware it is crucial that users update software and operating systems with the latest patches. Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
Other methods include, network segmentation and segregation into security zones – help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
