New Clop Ransomware Encrypts Windows Processes

Researchers have spotted new ransomware with a nasty new twist. "Clop," as it's called, doesn't just encrypt files, but deliberately attempts to screw up applications as well.

The move is most likely intended to reduce the chances of the ransomware being blocked, but also means an attack could be even more disruptive and make it more likely a complete rebuild of the affected PC is necessary.

Normally ransomware's main task is to encrypt as many files as possible on a computer. The idea here is to extort the user by forcing them to pay a ransom to regain access to the locked files.

The ideal case for an attacker is to find a victim that has the money to pay the ransom, but doesn't have the capability to protect themselves against attacks or have suitable backups. The problem is that ransomware culprits often rely on a blanket distribution of malware, which means non-targeted users end up getting caught up in the attack.

600+ Windows Processes Targeted

It's not unusual for ransomware to attempt to disable security software before it begins the encryption. Often this involves cyber criminals remotely connecting to a PC with details of software to target.

However, a new variant of a well-known ransomware called Clop takes things a step further. It's got a built-in list of 663 processes to shut down before unleashing the encryption. This includes numerous applications including Microsoft Office, Notepad and even the Windows calculator tool. (Source: bleepingcomputer.com)

Ransomware Misery Increases

The precise reasons for this tactic aren't known for certain, though clearly it's not over fears that these applications could stop the ransomware working.

One theory is that it's because encrypting an open file or active process is far more difficult; in this case, the operating system denies access to the ransomware encryption because the open file or active process is in use.

It's theorized that shutting down these processes and open files would make it easier to encrypt configuration files for the applications, adding to the frustration users experience. (Source: forbes.com)

Another possibility is that this tactic could make it easier to encrypt documents and other files that the PC owner is actively using at the moment the ransomware strikes. By definition, those are the files least likely to be adequately backed up. That could make the victim more likely to pay up, particularly in organizations which rely on up-to-date data.

What's Your Opinion?

Would you consider paying ransomware? Would you worry that doing so simply encouraged further attacks? How would you cope if most or all files on your PC became inaccessible in such an attack?