SonicWall’s threat research team recently uncovered a new variant of the StopCrypt ransomware, also referred to as STOP, which has not been widely discussed despite its broad distribution. This latest iteration uses an advanced multi-stage execution approach, integrating shellcodes and various evasion techniques to avoid detection by security defenses. Although there was an initial oversight in identifying the ransomware sample as new, subsequent examination affirmed that the innovative attack strategies detailed are indeed applicable to the most recent version of the STOP ransomware.
Known also as STOP Djvu, StopCrypt mainly preys on individual users instead of corporations, with the aim of extracting smaller ransoms ranging between $400 and $1,000. The ransomware spreads via malvertising and questionable websites that masquerade adware as legitimate applications. This distribution tactic has significantly affected numerous individuals, pushing them to seek help from cybersecurity professionals and online forums to regain access to their data.
Why it matters: The transformation of StopCrypt into an increasingly stealthy and intricate threat highlights a development in cybercrime, impacting an untold number of people/companies globally. Its sophisticated multi-stage execution and evasion tactics challenge the effectiveness of current security protocols. Additionally, its strategic targeting of individual consumers over large corporations emphasizes the severity. The outcomes of these tactics extend beyond mere financial detriment, potentially inflicting considerable emotional and psychological harm on victims.
- Unlike other high-profile ransomware operations that seek large ransom payments from businesses, StopCrypt’s strategy of targeting consumers with smaller demands broadens its impact, affecting a vast number of individuals with less visibility in the cybersecurity community.
- The widespread distribution of StopCrypt has fostered a significant community response, with victims seeking assistance through dedicated forums and expert guidance, highlighting the importance of collaborative efforts in combating ransomware threats.
- The ransomware secures its persistence on infected systems through modifications to access control lists and the creation of scheduled tasks, ensuring continuous execution. It encrypts files and appends a unique “.msjd” extension, among hundreds of potential extensions, complicating recovery efforts.
