A new crypto-ransomware called “Bart” denies victims access to their files without the use of command-and-control (C&C) infrastructure or AES encryption.
Researchers at security firm ProofPoint explain that they first came across the ransomware at the end of last week:
The Locky ransomware has made quite a name for itself since it was discovered back in February.
Attackers used the Locky ransomware to target the Hollywood Presbyterian Medical Center in early spring 2016. Ultimately, the hospital conceded to the attackers’ demands and agreed to a ransom payment of 40 BTC (approximately US $17,000).
Since then, Locky impersonators and dark web marketplaces claiming to sell variants of this ransomware have been popping up online. Researchers have also been working hard to stem the tide of Locky infections.
Locky appears to have had a profound impact on Bart. Take a look at this newest ransomware’s payment portal:
It’s exactly the same as Locky’s except for the fact that it asks for 3 Bitcoin (approximately US $1,800) instead of the 0.5 BTC demanded by Locky:
Rest assured, however, that Bart isn’t a Locky copy. This new ransomware distinguishes itself from most other ransomware in two ways when it comes to its encryption algorithm.
First, the ransomware doesn’t have any C&C infrastructure. Instead it uses a victim identifier to tell the threat actor what decryption key they should use to create a decryption application.
Second, Bart doesn’t deny victims access to their files in the same way as other crypto-ransomware. Researchers at PhishMe explain:
“Most encryption ransomware has traditionally relied upon a sophisticated asymmetric, public-private key pair or the creation of a distinct symmetric encryption key for encryption. This key is generally passed to the threat actor’s infrastructure at the time of encryption for later use. However, Bart simply places its targeted files in individual zip archives and applies password protection to these archives.”
#Bart #ransomware encrypts files by packing in password protected ZIP archive pic.twitter.com/odg8KhXgpD
— hasherezade (@hasherezade) June 25, 2016
At this time, there is no decryptor available for victims affected by Bart. That means users need to follow best ransomware prevention practices, such as by exercising caution around suspicious links and email attachments. They should also back up their files just in case.
In addition, organizations could block Bart at the email gateway by setting rules that automatically filter out emails with zipped executables.
Found this article interesting? Follow Graham Cluley on Twitter or Mastodon to read more of the exclusive content we post.