CryptoWall V3 and V4 Protection for McAfee Customers

By on Oct 29, 2015

Updated, November 6: 

Since October 30, the release date of the Cyber Threat Alliance report on CryptoWall Version 3, we have spotted a new variant of the CryptoWall family. This variant has been labeled by many as Version 4, which is different in some ways from V3. This rapid update demonstrates how flexible the actors behind these campaigns are and the resources they have available to make changes within 24 hours. McAfee detects this new version in our signatures as Ransom-CWall.a and Ransom-CWall.c.

As part of a joint investigation between the founding members of the Cyber Threat Alliance, we released a report that dissects the CryptoWall Version 3 family of ransomware. (For more on the malware’s aims, see this post.) Threat researchers from four companies, including McAfee, shared indicators and knowledge around the inner workings of this malware and how it behaves from a network perspective.

For McAfee customers, we have written detection for our endpoint products that classifies the ransomware as Ransom-Cwall. Besides our endpoint products, other products that consume McAfee Global Threat Intelligence feeds also detect the indicators of this ransomware family and protect our customers by blocking access to its control servers.

Indicators of associated URLs and IP addresses have been pushed into McAfee GTI and are updated daily  as we proactively monitor the movements of the campaigns that spread this form of ransomware.

While monitoring McAfee GTI statistics around this campaign, we saw starting in August a high number of detections in which the current control server sites were increasingly blocked and the number of visitors to these sites decreased:

CW3 control servers

 

As the CTA contributing members began to block these sites, we saw the adversaries behind the campaigns move to new sites for their control servers, which explains some spikes in September. McAfee continues to monitor this ransomware threat and provide up to date information and detection in our products.

About the Author

Christiaan Beek

Christiaan Beek, lead scientist & sr. principal engineer is part of Mcafee’s Office of the CTO leading strategic threat intelligence research within Mcafee. He coordinates and leads passionately the research in advanced attacks, plays a key-role in cyberattack take-down operations and participates in the NoMoreRansom project. In previous roles, Beek was Director of Threat Intelligence ...

Read more posts from Christiaan Beek

Subscribe to McAfee Securing Tomorrow Blogs