As part of a joint investigation between the founding members of the Cyber Threat Alliance, we released a report that dissects the CryptoWall Version 3 family of ransomware. (For more on the malware’s aims, see this post.) Threat researchers from four companies, including Intel Security, shared indicators and knowledge around the inner workings of this malware and how it behaves from a network perspective.
For Intel Security customers, we have written detection for our endpoint products that classifies the ransomware as Ransom-Cwall. Besides our endpoint products, other products that consume McAfee Global Threat Intelligence feeds also detect the indicators of this ransomware family and protect our customers by blocking access to its control servers.
Indicators of associated URLs and IP addresses have been pushed into McAfee GTI and are updated daily as we proactively monitor the movements of the campaigns that spread this form of ransomware.
While monitoring McAfee GTI statistics around this campaign, we saw starting in August a high number of detections in which the current control server sites were increasingly blocked and the number of visitors to these sites decreased:
As the CTA contributing members began to block these sites, we saw the adversaries behind the campaigns move to new sites for their control servers, which explains some spikes in September. Intel Security continues to monitor this ransomware threat and provide up to date information and detection in our products.
The post CryptoWall V3 Protection for Intel Security Customers appeared first on McAfee.