Password Stealing Malware Makes a Comeback With Ransomware as a Partner

Is it ransomware or is it a password stealing bot? The answer is…. it’s both! An older banking Trojan called Betabot has resurfaced again with a one-two punch to victims. It first gets onto a victim’s computer when the user opens an infected Microsoft Word document that has macros enabled. It proceeds to steal browser-stored passwords, then bam! It drops in the ransomware, just for kicks.

The FBI first warned about Betabot in 2013. It was able to disable anti-malware and ultimately steal those passwords that were saved in browsers, and still can. It has come back in a new and “improved” way by using the Cerber ransomware as another weapon.

Remember that malware isn’t limited to an executable file anymore. These days, cyber criminals are using documents, spreadsheets, compressed (zipped) files, and even PDFs to harbor it. A lot of the times, as it is in this case, the malware is deployed when macros are enabled in the document or Excel file. Sometimes, it’s as simple as just opening the file. This particular document is disguised as a resume.

By default, all macros should be disabled for security. In newer installations of Microsoft Office programs, macros are disabled upon initial installation of the software. If you don’t need them enabled most of the time, don’t change it. If you have an older installation of MS Office, go into your settings and disable them. This will require an action from you when a file needs to use macros. A good rule of thumb is that if you didn’t create the macros or you don’t know who did, don’t enable them.

If you receive an attached file or a link in an email that is not expected, make sure it is legitimate before clicking on it. You can see where a link goes by hovering over it with your mouse pointer on a desktop or laptop computer or by holding down on it for a few seconds on mobile devices. If it doesn’t go where you’d expect, it could be malicious. If you didn’t expect an attachment, call the sender or walk to his or her desk and make sure they meant for you to open it. Don’t assume that’s the case, even if it appears you know the sender. Remember that professional email is now targeted as frequently, or more often than personal email addresses. Don’t think you are protected from phishing just because you’re at the office.

Don’t store passwords in your browser. This just makes them available to these types of attacks. Even if they are strong ones and are unique to each site, as they should be, storing them there doesn’t do any good in these cases.

If you should fall victim to ransomware, don’t pay to get your files decrypted like the Hollywood Presbyterian Medical Center did. Instead, restore from a backup. To do this, make sure you are proactive and do regular backups of your important files. This could mean daily, but in some cases such as for hospitals, perhaps more often is appropriate. At home, it may mean weekly.

Cerber is a form of ransomware that uses a ransomware-as-a-business model. Using it, cyber criminals extorted around $195,000 from victims this past summer. According to a data from Check Point, it’s author nets nearly $1 million per year.

So why bother with the one-two punch? Security experts think the hackers are really after the passwords to be sold on the Dark Web. However, why not maximize the profits with ransomware while they’re at it and grab ransom money too?