Incident Response, Malware, Network Security, TDR

Locky ransomware bolsters encryption of communications with C&C servers

Bradley BarthMay 10, 2016

In a move to obfuscate network traffic more effectively, Locky ransomware developers have recently upgraded the malware to communicate with its command and control server via both symmetric and asymmetric encryption, as opposed to custom encoding.

FireEye Labs, the research division of FireEye, detailed this new development in Locky's evolution in a blog post. While observing recent samples of the malware, FireEye found that when Locky contacts the control server to obtain a public key for encrypting a victim's files, Locky initially generates AES (Advanced Encryption Standard) keys and encrypts its plain text request, and then subsequently encrypts the AES keys.

“Locky has moved from using simple encoding to obfuscate its network traffic to a complex encryption algorithm using hardware instructions that are very hard to crack,” the researchers wrote.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.