Lucky Ransomware

The Lucky Ransomware is a file-locking Trojan that can keep your media from opening by encrypting it with AES. Threat actors are using software vulnerabilities for distributing this Trojan to its victims, and the users can protect themselves by installing the appropriate security fixes. Most anti-malware products, also, should quarantine or delete the Lucky Ransomware by default, saving them from the need to decrypt the files or restore them from backups.

Trojans Hoping to Get Lucky against Old Software

New file-locking Trojans using exploits similar to those of the SamSam Ransomware or the Satan Ransomware campaigns are becoming security hazards to the public, with malware experts confirming attacks against various Asian countries. While the Lucky Ransomware is not, so far, classifiable as a relative of either of the two past threats, it does share a commonality with them: using vulnerabilities in Apache, JBoss, Tomcat, and other software as infection opportunities. The Lucky Ransomware also displays the semi-unique characteristic of having compatibility with both Windows and Linux systems.

Remote code execution, brute-force attacks, and deserialization vulnerabilities are some of the exploits in use for the Lucky Ransomware, which is compromising users in Japan and China. The Lucky Ransomware uses a variant of the AES encryption for locking documents, images, and other file types in various locations, such as the desktop, downloads, music and pictures folders. For identifying what's encrypted, malware experts are noting that the Lucky Ransomware is one of the few file-locker Trojans that includes both appended and prepended filename data: a prepended e-mail, followed by the original name, and, then, random characters and a '.lucky' extension.

The cyber-security industry at large has yet to analyze the cryptographic features of the Lucky Ransomware's payload in-depth. Unlocking these files with free software may be either possible or impossible, and users should consider backing their work up regularly as a dependable and inexpensive alternative. They also may check for the presence of unerased restore points in Windows, even though the majority of file-locker Trojans include countermeasures against them. The wallet for the Lucky Ransomware's campaign does show some signs of use, but no ransom payments.

Making Sure that It's Your Media's Lucky Day

Patching software vulnerabilities like JBoss's CVE-2013-4810 or EternalBlue will remove many of the security issues that let threat actors drop file-locker Trojans and other threats onto your system automatically. Network admins should also be on guard for non-secure logins or potentially unsafe e-mail messages, which have frequent involvement in the campaigns of file-locker Trojans. Since a remote attacker may retain access to your PC after dropping the Trojan, disabling all network connections should be one of the first steps taken for re-securing the system.

The Lucky Ransomware's current statistics place it as being operational throughout Asia widely, but other regions may be at risk, as well. Since this threat includes semi-automated distribution features for Linux systems, its campaign is one of the few, definitive cross-platform ones that can block media equally well in diverse environments. Compatible anti-malware tools, still, should be viable for uninstalling the Lucky Ransomware or, more ideally, stopping it in the first place.

There's nothing that's 'lucky' about the Lucky Ransomware's payouts, so far. To keep it that way, users shouldn't assume that saving their work in one location with no further protection is a good idea.