Sodinokibi ransomware has got even nastier
Version 2.2 of the ransomware uses the Windows Restart Manager API to encrypt even more files
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A new feature has been added to theSodinokibi ransomwarethat allows it to encrypt even more of a victim’s files including those that are opened and locked by another process.
Databases, mail servers and some other applications will lock files that they have open to prevent other programs from modifying them. By locking these files, the programs prevent the data they contain from being corrupted as a result of two processes writing to a file at the same time.
Ransomware applications are also unable to encrypt locked files without first shutting down the process that locked them in the first place. For this reason, ransomware will try to shut down database servers, mail servers and other applications that have the ability to lock files before encrypting a computer.
Version 2.2 of the Sodinokibi ransomware now contains a feature that allows it to use the Windows Restart Manager API to close processes or shut down Windows services which keep files open during encryption.
Sodinokibi revamped
The cybercrime intelligence firm Intel471 provided more details on how the Sodinokibi (REvil) ransomware is using the Windows Restart Manager to encrypt even more files in anew report, saying:
“One of the more interesting new features of REvil version 2.2 is the use of the Windows Restart Manager to terminate processes and services that can lock files targeted for encryption. If a process has an open file handle for a specific file, then writes to that file by another process (in this case, a ransomware) it will be prevented by the Windowsoperating system(OS). To circumvent this, the REvil developers have implemented a technique using the Windows Restart Manager also used by other ransomware such as SamSam and LockerGoga.”
The Windows Restart Manager API was originally created byMicrosoftin order to allow Windows PCs to easily install software updates without first performing a restart in order to free files that the update will replace.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Now that Sodinokibi is using the software giant’s API, victims will be able to more easily decrepit files after paying a ransom but more of their files will end up being encrypted by the ransomware.
ViaBleepingComputer
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Quordle today – hints and answers for Saturday, November 9 (game #1020)
