{"id":34306,"date":"2019-01-31T19:45:22","date_gmt":"2019-01-31T11:45:22","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=34306"},"modified":"2019-01-31T19:45:27","modified_gmt":"2019-01-31T11:45:27","slug":"sophos-releases-report-on-matrix-ransomware","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2019\/01\/31\/sophos-releases-report-on-matrix-ransomware\/","title":{"rendered":"Sophos releases report on Matrix ransomware"},"content":{"rendered":"\n

Sophos<\/strong><\/a>,\u00a0a player in network and endpoint security, released a new report about a ransomware family called Matrix. The malware has been operating since 2016 and Sophos has tracked 96 samples in the wild. Like previous targeted ransomware, including BitPaymer, Dharma and SamSam, the attackers who are infecting computers with Matrix have been breaking in to enterprise networks and infecting those computers over\u00a0Remote Desktop Protocol (RDP), a built-in remote access tool for Windows computers. However, unlike these other ransomware families, Matrix only targets a single machine on the network, rather than spreading widely through an organization.\u00a0 <\/strong><\/p>\n\n\n\n

In its\nlatest paper, SophosLabs reverse engineered the evolving code and\ntechniques employed by the attackers, as well as the methods and ransom notes\nused to attempt to extract money from victims. The Matrix criminals evolved\ntheir attack parameters over time, with new files and scripts added to deploy\ndifferent tasks and payloads onto the network.<\/p>\n\n\n\n

Matrix ransom\nnotes are embedded in the attack code, but victims don’t know how much they\nmust pay until they contact the attackers. For most of Matrix’s existence, the authors used a\ncryptographically-protected anonymous instant messaging service, called bitmsg.me<\/a><\/strong>, but that service has now been\ndiscontinued and the authors have reverted to using normal email\naccounts. The threat actors behind Matrix make their\ndemand for cryptocurrency ransom in the form of a U.S. dollar value equivalent.\nThis is unusual as demands for cryptocurrency normally come as a specific value\nin cryptocurrency, not the dollar equivalent. It’s unclear whether the ransom\ndemand is a deliberate attempt at misdirection, or just an attempt to surf\nwildly fluctuating cryptocurrency exchange rates. Based on the communications\nSophosLabs had with the attackers, ransom demands were for US$2,500, but the\nattackers eventually reduced the ransom when researchers stopped responding to\ndemands. <\/p>\n\n\n\n

Matrix is\nvery much the Swiss Army Knife of the ransomware world, with newer variants\nable to scan and find potential computer victims once inserted into the\nnetwork. While sample volumes are small, that doesn’t make it any less\ndangerous; Matrix is evolving and newer versions are appearing as the attacker\nare improving on lessons learned from each attack.<\/p>\n\n\n\n

Sophos\u2019 2019 Threat Report<\/a> highlighted that targeted ransomware will be driving hacker behavior, and organizations need to remain vigilant and work to ensure they are not an easy target.<\/p>\n\n\n\n

Sophos\nrecommends implementing the following four security measures immediately:<\/strong><\/p>\n\n\n\n