Security researchers uncovered that a version of Jigsaw, an old ransomware , has resurfaced as a bitcoin stealer. This iteration of Jigsaw (detected by Trend Micro as RANSOM_JIGSAW.THGBDAH) is also known as BitcoinStealer through strings embedded in the malware’s code. The malware steals the contents of the victim’s bitcoin wallet by using an open-source command-line tool (VanityGen) to modify the victim’s bitcoin address to divert its contents to the cybercriminal’s account.
The subtle modification can mislead victims into thinking that the cybercriminal and victim’s bitcoin addresses are similar. It does this by using VanityGen to alter the bitcoin address in clipboards.
According to the researchers, the cybercriminals have already netted 8.4 bitcoins (US$66,807 as of July 24, 2018) using the repurposed malware. They also saw similar cryptocurrency address-modifying services peddled in dark web forums and websites.
[From TrendLabs Security Intelligence Blog: Technical analysis of the first version of the Jigsaw ransomware ]
Emerging as a file-encrypting malware in April 2016, Jigsaw pressured victims into paying the ransom by setting a time limit and incrementally deleting files. It has since evolved and matured, using tactics and business models that included incorporating live chat support and revamping its ransom notes (e.g., using images from the Saw films and Anonymous) and demands.
Given that Jigsaw’s source code has long been available online, it’s unsurprising that cybercriminals rehashed it into a malware that cashes in on cryptocurrency’s popularity. And Jigsaw isn’t the only one to adapt to the times.
A recent example is the Rakhni trojan , which can deliver either a ransomware or cryptocurrency-mining malware depending on the affected system’s configurations. Trickbot, initially known as an information stealer, incorporated screen-locking capabilities typically associated with ransomware. Cerber ransomware also added cryptocurrency theft to its routines. Cybercriminals also used notorious exploits like EternalBlue to mine cryptocurrency. In 2017, cryptocurrency mining was the most detected network event in devices connected to home routers.
[RELATED: Cryptocurrency-mining Malware: 2018’s New Menace? ]
Jigsaw is just one example of how threats continue to adapt, evolve, and ride on popular trends — such as cryptocurrency mining. Here are some best practices :
Trend Micro endpoint solutions such as the Smart Protection Suites and Worry-Free Business Security solutions can protect users and businesses from threats by detecting malicious files and messages as well as blocking all related malicious URLs. The Trend Micro™ Deep Discovery™ solution has an email inspection layer that can protect enterprises by detecting malicious attachments and URLs.
Trend Micro XGen™ security provides a cross-generational blend of threat defense techniques to protect systems from all types of threats, including ransomware and cryptocurrency-mining malware. It features high-fidelity machine learning on gateways and endpoints , and protects physical, virtual, and cloud workloads. With capabilities like web/URL filtering, behavioral analysis, and custom sandboxing, XGen™ security protects against today’s threats that bypass traditional controls; exploit known, unknown, or undisclosed vulnerabilities; either steal or encrypt personally identifiable data; or conduct malicious cryptocurrency mining. Smart, optimized, and connected, XGen™ security powers Trend Micro’s suite of security solutions: Hybrid Cloud Security , User Protection , and Network Defense .
Like it? Add this infographic to your site:1. Click on the box below.   2. Press Ctrl+A to select all.   3. Press Ctrl+C to copy.   4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
In the first half of this year, cybersecurity strongholds were surrounded by cybercriminals waiting to pounce at the sight of even the slightest crack in defenses to ravage valuable assets. View the report
The upheavals of 2020 challenged the limits of organizations and users, and provided openings for malicious actors. A robust cybersecurity posture can help equip enterprises and individuals amid a continuously changing threat landscape. View the 2020 Annual Cybersecurity Report
cardingforumco carderim