Matrix Ransomware is back under the distribution of RIG Exploit Kit

Security researcher Jérôme Segura of Malwarebytes has discovered Matrix Ransomware being distributed through RIG exploit kit on malicious display sites.

Matrix Ransomware was first distributed at the end of 2016 and it was destroyed in April 2017. Since then, this ransomware has disappeared until it was discovered yesterday.

According to Segura, Matrix ransomware is installed via exploitation packages on the website displaying malicious ads, aimed at vulnerabilities in Internet Explorer (CVE-2016-0189) and Flash (CVE-2015-8651). Both of these vulnerabilities are based on users using the updated versions of Internet Explorer and Flash Player.

The infection method is quite simple, only if the user has access to one of the websites containing malicious ads using a poor security computer, he will be infected with ransomware. This is also the reason users should regularly install security updates available in the installation program and operating system.

After infecting the computer, the current Matrix Ransomware version will encrypt the files on the device, get the file name and add the .pyongyan001 @ yahoo.com utility to the file name stolen. Below is an example of an encrypted folder.

Matrix Ransomware is back under the distribution of RIG Exploit Kit Picture 1

During infection, this ransomware will also send a note to the user about the ransom named # _ # WhatsWrongWithMyFiles # _ #. Rtf in the folder containing the encrypted file. Finally, it will display the notification screen, providing information about what happened to the file and instructing the user how to resolve it.

Matrix Ransomware is back under the distribution of RIG Exploit Kit Picture 2

How to protect your computer from Matrix Ransomware

To protect your computer against Matrix Ransomware threat, first, you need to make sure that you have updated all Windows security updates and other programs.

You should also create a reliable data backup that can be restored in an emergency.

Install security software containing malicious behavior detector like Malwarebytes or Emsisoft Anti-Malware. If you are using Windows 10 Fall Creators Update, you can also use the Controlled Folder Access feature to protect important documents from the risk of encryption.

Last but not least, you should create your own online security habits when using email, be cautious of unknown attachments, .

Micah Soto

Update 23 May 2019

You should read it

May be interested

General guidelines for decoding ransomware
in this guide, tipsmake.com will try to help unfortunate readers infected with ransomware and encrypted files on the computer.
What is Ransomware Task Force (RTF)?
ransomware has become one of the top security threats in the past three years. the first ransomware strain and one of the worst nightmares in the history of global cybersecurity - wannacry - was discovered in may 2017.
[Infographic] 7 effective ways to protect businesses from Ransomware
how to protect your business from ransomware? join tipsmake.com to follow the article to find the answer.
How to decode ransomware InsaneCrypt (Everbe 1.0)
ransomware insanecrypt or everbe 1.0 is a ransomware family based on an open source project. this ransomware family is distributed through spam and hacked into remote desktop services, but this is not yet confirmed.
Why is Ransomware the perfect hack?
it is difficult to get an accurate number of cyber attacks, but the available data on ransomware give a poor picture.
Learn about Ransomware: 6 ransomware on computers
what is ransomware? are there any other ransomware? how does ransomware attack computers and demand ransom from users?
Detecting two unusual versions of ransomware, shows that the world of ransomware has become diversified
international cybersecurity researchers recently found two completely new types of ransomware that are quite strange. they carry very different and rarely recorded features, which are the alarm bells, showing that the world of ransomware has become diverse.
What is Fargo Ransomware? How to avoid?
ransomware is a major threat to the digital world, made even more so by cybercriminals coming up with various strategies. one way to solve the problem is to learn how these attacks work.
Warning: Quantum Ransomware is being rapidly deployed in lightning attacks
ransomware (ransomware) is probably not a new concept for most computer users. however, quantum ransomware is a term not everyone has heard of.
Ransomware can attack the CPU, not just the operating system: How to prevent it?
ransomware is a serious problem in its current state and is only going to get worse. any security programs and measures will be rendered useless when ransomware attacks the cpu.

Matrix Ransomware is back under the distribution of RIG Exploit Kit

How to protect your computer from Matrix Ransomware

You should read it

May be interested

Attack the network