The topic of ransomware seems to be entwined with Bitcoin these days, and two-year-old malware Bucbi is jumping on the cryptocurrency bandwagon. In its new form, the Bucbi ransomware will target specific victims and demand a five-Bitcoin ransom.
Also read: Kripos Shuts Down Major Dark Web Drugs Marketplace
Bucbi Infections Are Not Random
It is not the first time this particular strain of ransomware makes an appearance on the security researchers’ radar, as Bucbi has been around for two years now. In its previous iteration, this malware seemed to infect computers randomly, with no clear plan of attack other than trying to rake in as much money as humanly possible.
To be more precise, Bucbi would be spread through large campaigns combining email attachments and malicious websites. However, that has come to a change, as the creators are now going after corporate networks running Remote Desktop Protocol servers. By using the RDP brute force utility called “RDP Brute”, attackers can gain a foothold on these servers with relative ease.
The latest iteration of Bucbi was identified by Palo Alto security researchers a week ago, as a Windows Server was infected by this malware. As part of the attack, the server owner had to pay a fee of five bitcoins to restore file access, worth US$2,320 at the time of infection. Quite a significant amount, but still a lot cheaper than shutting down critical enterprise services for an extended period.
What is even more concerning is how this method of attack can also be used to target point of sales systems in the future. However, their brute force approach is not always successful in getting the compromised devices to execute financial transactions. Going after corporate servers seems to be a more lucrative business model for these bad actors, as Bucbi can be used to sniff out sensitive information and encrypt files.
For the time being, there is a lot of speculation as to who is behind the Bucbi ransomware. Some security experts feel the Ukrainian Right Sector is behind these attacks, although that has not been confirmed by official sources at the time of writing. The ransomware business is booming, unfortunately, and the resurgence of Bucbi is a clear example of how grave this threat can be.
What are your thoughts on Bucbi and its potential? Let us know in the comments below!
Source: Threatpost
Images courtesy of Shutterstock, Sensors Tech Forum