Slashdot Mirror
New Ransomware 'Jaff' Spotted; Malware Groups Pushing 5M Emails Per Hour To Circulate It (theregister.co.uk)
An anonymous reader writes: The Necurs botnet has been harnessed to fling a new strain of ransomware dubbed "Jaff". Jaff spreads in a similar way to the infamous file-encrypting malware Locky and even uses the same payment site template, but is nonetheless a different monster. Attached to dangerous emails is an infectious PDF containing an embedded DOCM file with a malicious macro script. This script will then download and execute the Jaff ransomware. Locky -- like Jaff -- also used the Necurs botnet and a booby-trapped PDF, security firm Malwarebytes notes. "This is where the comparison ends, since the code base is different as well as the ransom itself," said Jerome Segura, a security researcher at Malwarebytes. "Jaff asks for an astounding 2 BTC, which is about $3,700 at the time of writing." Proofpoint reckons Jaff may be the work of the same cybercriminals behind Locky, Dridex and Bart (other nasty malware) but this remains unconfirmed. And Forcepoint Security Labs reports that malicious emails carrying Jaff are being cranked out at a rate of 5 million an hour on Thursday, or 13 million in total at the time it wrote up a blog post about the new threat.
...I have 100% backups of every computer on my LAN, every night, stored to an external drive, one of three that I rotate among. The backups are automatic, concluded by shutting down the computer from which the backup was just copies to disk, every night. I have about a weeks' worth of backups on each disk, for each computer on the LAN, so I have about three weeks' worth of backups on hand. Rolling back is easy, and takes less than an hour.
I'll never understand how technologists--who claim they are professionals--can leave their own or others' computers unprotected by backups, automatically made ('cause if they're not automatic, they'll never get made).
Sure, anti-virus and malware detection is important, but my backups are the final defense against miscreants like those who create these malicious invasion methodologies.