Ransomware attacks are one of the most common cyber threats nowadays and hackers are increasingly trying to update their attack methods to make the biggest revenues. Specialists in system audits have reported the emergence of a new variant of malware that seems to act like ransomware; however, instead of encrypting the victims’ files, attackers overwrite all the information, so you can’t even tell they intended to restore people’s information.
The first reports, emerging a few days ago, described the detection of a ransomware campaign attacking users in German-speaking territories; victims of these attacks claimed that the malware completely erased the data from the compromised system. However, cases of infection soon occurred in other parts of Europe.
Malware, dubbed GermanWiper by system audits specialists, is technically considered a ransomware, although the malware does not encrypt the victim’s information, but overwrites all information with meaningless characters, rendering useless any file stored by the victim.
This class of malware, known as wiper, is used by disruptive threat actors that generate serious economic losses for attacked organizations. However, the operators of this campaign do not hesitate to demand ransoms from victims, even though their information has already been deleted when they find the ransom note.
According to system audits experts, GermanWiper is distributed using a massive spam campaign. Attackers send emails, supposedly sent by job seekers to different areas of target organizations. In the email you will find an attachment containing the malware; after running the files containing the attachment begins the infection.
From the attachment come two files in PDF format which are actually links to run a PowerShell command and install the malware on the target system. When the malicious code reaches the victim’s computer, it runs locally automatically and deletes the user’s information.
When the malware finishes this process, the ransom note appears on the victim’s screen, which reports on the supposed encryption of files and demands a payment of around 0.16 Bitcoin which should be transferred to an address specified in the message. Because the malware deletes the user’s information instead of encrypting it, it is important that GermanWiper victims do not give in to the attackers’ demands, as there is no way they can retrieve their information.
Specialists in system audits from the International Institute of Cyber Security (IICS) say that, although very limited, activity of this malware has been detected outside Germany and other countries in Europe. Some of the countries that have reported GermanWiper infections are Ireland, Hungary, Spain, England and even some Asian countries, such as Taiwan and China.
As protection measures against potential GermanWiper infections, users are advised to back up their most important files, at the same time, it is important to remember that, if possible, these backups should be stored in some physical location without an Internet connection; training your employees in the detection and mitigation of spam and phishing attacks is also advisable, however, backup is the best way to prevent information loss by wiper malware.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
