Another ransomware nightmare could be brewing in Ukraine – media

15:40, 22 May 2017
Ukraine
251 0

Just as the reverberations from last week's WannaCry ransomware outbreak have started to slow, a new threat has already cropped up. A virulent ransomware strain called XData has gained momentum in Ukraine, so far leading to about three times as many infections as WannaCry did in the country, according to Wired.

Screenshot

That XData appears to target Ukraine specifically tempers some fears, but were it to spread globally it would potentially leave even more devastation than last week's WannaCry mess, Wired reported.

Discovered on Thursday by MalwareHunter, a researcher with the MalwareHunterTeam analysis group, XData had 94 detected unique infections as of midday Friday, and the number was rising. In contrast, MalwareHunterTeam's data indicates that there were less than 30 WannaCry infections in Ukraine in all (the total number of infections worldwide was about 200,000). A few dozen cases may not sound like a lot. But considering that WannaCry infected 200,000 devices out of the billions of devices in the world, rate of infection is an important indicator. An outbreak moving this much faster than WannaCry did, even in an isolated setting, portends deeper troubles if it goes global.

Read alsoResearchers say global cyber attack similar to North Korean hacks – ReutersExperts are still analyzing the ransomware to identify how it infects devices and spreads, but so far XData shows at least some level of sophistication. That's in contrast to WannaCry, whose creators' incompetence limited its scope. Researchers have confirmed that XData fully encrypts the files it claims to, and that there isn't a way to get around the process and decrypt the files for free, as you can with WannaCry in some cases on Windows XP and Windows 7.

Curiously, XData doesn't specify an amount of money it requires to release hostage files. MalwareHunter speculates that the attackers may set the ransoms on a victim-by-victim basis, depending on whether they are individuals or businesses.

If you see a spelling error on our site, select it and press Ctrl+Enter