New 0-Day Ransomware Evades Microsoft, Google Cloud Malware Detection[darkreading]

11 Feb 2018

No Comments

1417

Shurl0ckr, a form of Gojdue ransomware, was not detected on SharePoint or Google Drive.

Google Drive and Microsoft Office 365, both of which have built-in malware protection, failed to identify a new form of Gojdue ransomware dubbed Shurl0ckr. The zero-day ransomware evaded most major antivirus platforms: only seven percent of 67 tested tools detected it.

Researchers on the Bitglass Threat Research Team discovered Shurl0ckr during a scan of malware in the cloud. It was confirmed as a form of ransomware-as-a-service by Cylance.

Shurl0ckr works the same way as Satan ransomware. A hacker creates a ransomware payload and distributes it via phishing or drive-by download. The malware encrypts files on disk in the background until the victim pays a Bitcoin ransom. Hackers pay a percentage to the author.

The discovery was part of a broader study on malware in the cloud. Researchers found 44% of businesses they scanned had some form of malware in at least one of their cloud applications. One in three corporate instances of SaaS applications were infected with malware.

Microsoft OneDrive had the highest rate of infection compared with other major SaaS applications, with 55% of instances hit. Google Drive was next-highest at 43%, followed by Box and Dropbox, both of which had a 33% infection rate.

For more, click here.