Evil Ransomware Hiding Inside This - Protect Yourself

News
By published

Locky, a nasty piece of ransomware that has no easy fix, is back, and it’s ready to take advantage of Microsoft Word.

Malware spreading through Microsoft Word macros is making a comeback, and an old strain of ransomware has taken advantage of the trend. Locky, a particularly nasty piece of ransomware that has no easy fix, is back, and it’s taking advantage of your favorite word processor. Spotting it is fairly simple, but if you don’t practice commonsense online security, you can kiss your files goodbye — probably forever.

Credit: Pitipat Usanakornkul/Shutterstock

(Image credit: Pitipat Usanakornkul/Shutterstock)

The scam begins with an email with “Receipt” or “Payment Receipt,” followed by a random number, as the subject line. Attached is a PDF documenting your purported purchases that itself contains a prompt to open a document in Microsoft Word. The unsolicited, nonspecific receipt email, the attachment, and the PDF trying to open another program should all raise red flags.

Should you follow the steps anyway, then Microsoft Word will open and prompt you to run macros. This is where the average user could run into trouble: If Word macros are enabled by default, then the Locky ransomware will infect your computer. If not, you’ll get a prompt as to whether or not you want to let a Word macro run. Obviously, you should say no.

While the Locky ransomware is as disastrous as Sophos makes it sound — unlike with some other encrypting ransomware strains, there's no effective decryption tool available — the average user has no fewer than five opportunities to stop it.

First, delete any suspicious emails. Failing that, then at least don’t open any suspicious attachments. Should you disregard that advice, don’t let a PDF launch another application. Even if you’ve gone that far, you can still (probably) disallow Microsoft Word from running macros. As an absolute last line of defense, the Sophos antivirus program will stop this variant Locky from installing on your computer; some other AV programs will as well, but there’s no comprehensive list of which ones just yet.

If you haven’t tinkered too much with your Microsoft Word settings, you won’t need to worry about the program running macros without permission. Macros are a big security risk, so they're disabled in Word by default. Still, if you want to double-check (or if you’ve enabled macros, and want to disable them), open Microsoft Word, then go to File, Options, Trust Center and then Trust Center Settings, and make sure one of the "disable" settings is checked.

If you’re curious about what Locky does, it’s not pretty, but it’s pretty standard encrypting ransomware. The malware encrypts all of your files in an unreadable .OSIRIS format, then demands money in Bitcoin for a decryption key. In theory, it’s not a good idea to comply with the instructions; not all ransomware distributors keep their word to decrypt the files after payment, and exchanging information with cybercriminals can give them further personal details to leverage against you.

After Locky infects your machine, you can’t do much except wait and hope that security researchers eventually devise a decryption method someday. Back up your data regularly, keep your system patched, run a reliable antivirus program and don’t open strange emails. This won’t prevent 100 percent of cyberattacks, but it will prevent about 99 percent of them, and those are pretty good odds.

TOPICS
Marshall Honorof
Marshall Honorof

Marshall Honorof was a senior editor for Tom's Guide, overseeing the site's coverage of gaming hardware and software. He comes from a science writing background, having studied paleomammalogy, biological anthropology, and the history of science and technology. After hours, you can find him practicing taekwondo or doing deep dives on classic sci-fi.