CryptoWall 4.0 ransomware gets smarter and thus more dangerous
CryptoWall is a Trojan malware that encrypts files on a compromised computer and then demands a ransom from the unfortunate owner in order for the files to be unencrypted. Heimdal Security released a report yesterday stating that it recently discovered a fourth generation of CryptoWall that is significantly more effective and hence more dangerous. The key differences in its approach ar its distribution and in the extent of its encryption.  The malware is distributed in an Angler exploit kit within a "drive-by" phishing email, which invites the hapless victim to buy a software package for $700 and saying "Congratulations! You have become a part of large community CryptoWall!" 

CryptoWall 4.0, the newest version of the CryptoWall ransomware, is being packed into the Angler exploit kit and spreading through a new drive-by download campaign, according to researchers at Heimdal Security.

Heimdal first discovered CryptoWall 4.0 in the wild just one month ago. It's stealthier than earlier versions of the ransomware -- it encrypts not just files, but filenames too.

It also uses a strikingly different ransom message. Instead of demanding payment and trying to frighten the user, the new variant tries to convince a user to buy a $700 "software package" and delivers veiled threats within a message that begins "Congratulations! You have become a part of large community CryptoWall!"

The new attack campaign uses what Heimdal calls a "stack of drive-by campaigns," that hit the victim with multiple payloads, including the Pony information stealer, the Angler exploit kit, and ultimately, CryptoWall.

The victim is first hit the the Pony information stealer, which scrapes all the usernames and passwords it can find off the victim's system and sends them back to the attackers command-and-control server. Heimdal researchers state that the purpose is to find credentials for Web servers or content management systems and use them to inject malicious scripts into new sites, thus further broadening the attack campaign.

The victim is then redirected to another site that drops Angler, which scans the system for vulnerabilities and feeds it CryptoWall 4.0.

Heimdal has found over 200 new domains being used by attackers in the past 24 hours alone. The campaign originates from a hosting environment in the Ukraine, and has thusfar hit websites in Denmark particularly hard -- over 100 sites there have been injected with malware.