Malicious Code

Events with this classification type identify a system that is likely compromised and acts as a command and control server or distributes malware configurations. These systems are essential to control and manage the botnet drones. They distribute instructions, configurations, modules and malware updates.

Connection and access logs of such systems can be helpful for identifying and informing botnet victims and further investigate the incident. Depending on the data it could be used as evidence in criminal investigations, which has certain requirements. We strongly suggest you get in touch with trusted IT security professionals to help you determine the next steps.

The system identified by `source` is most likely infected with malicious software and acts as a command and control server or configuration distribution server. The system should be regarded as compromised, until further investigation has proven otherwise.

Recommendations:

• Contact a trusted organization or agency to determine the next steps. Please contact us if you need any assistance. Even if we are not the right partner for you, we might be able to help you get in touch with the the right organization.
• Contact us if you are willing to share the access information with us.
• Check access and application logs for unusual activity and additional information.
• Share the information with the trusted organization or agency to inform the victims.
• see also Malicious Code

Events with this classification type identify a system distributing malicious software. The infection usually happens by accessing a URL with a web browser. This does not necessarily mean that the malware is directly is hosted on this system or URL, as might simply load the malware from an other server.

There is a wide range of ways to get the visitors to access the URL to get infected. The most common one is to include links or scripts on vulnerable websites. An other way is to compromise the web server and redirect the visitor to an infected website. It is also possible that the website includes third party content, like advertising, etc., which could be providing malicious content, also called malvertising.

The underlying root cause can vary and might include sending spam, participating in DDoS attacks, redirecting users to exploit kits etc. A large subset of these compromises are caused by outdated versions of Content Management Systems such as Joomla/Drupal/Wordpress (or plugins for these) and weak or keylogged FTP credentials.

The system identified by source is most likely distributing malicious software to infect visitors. We strongly recommend against accessing the source.url with a web browser as you might get infected. The system or service should be regarded as compromised, until further investigation has proven otherwise.

Recommendations:

• Get professional assistance from your hosting provider or webmaster to remove the content.
• Check the logs for unusual behavior.
• Check for known vulnerabilities for any service running on the system. Apply the patches and/or configuration changes.
• see also Malicious Code

Events with this classification type identify a system infected by ransomware. Ransomware refers to malicious software that deny access to files or the system, and asks to provide payment before returning access to the user. This is essentially a local denial of service attack.

The most common ransomware encrypts the files stored on the system and likely also on connected network file shares. It is crucial to act quickly. Sometimes the encryption can be prevented by denying network access as the malware cannot get an encryption key or has to resort to store the key locally, allowing some tools to extract the decryption key.

There is no guarantee that any tools are able to help or are able to recover the data. There are even documented cases then after paying the ransom the criminals were not able to deliver the correct decryption key. The best way to mitigate this risk is to have system and data backups to be able to restore the encrypted files.

The system identified by source is most likely infected with malware with the ransomware functionality. The system should be regarded as compromised, until further investigation has proven otherwise.

Recommendations:

• Do not pay the ransom.
• Disconnect the system from the network.
• Check for further information. https://www.nomoreransom.org/
• Decide whether to turn off the system or not. (see advanced recommendations)
  Turning off the system could delete the decryption key from memory.
• Restore system and data from the backup if possible.
• see also Malicious Code

Advanced Recommendations:

• Dump the sytem memory, which could contain the encrytption key.
• Turn the system off to prevent further encryption.