The Cyber Threat Alliance (CTA), of which ReversingLabs is a contributing member, undertook a huge effort of pooling the Alliance’s collective resources to track and analyze CryptoWall, a prominent ransomware attack discovered in 2014. With the initial success of uncovering and subsequent protection against CW3, CTA continued to monitor CryptoWall’s activity to learn and understand the repercussions and reactions from the malware authors. Unsurprisingly, CryptoWall authors were not deterred with the publication of CW3 and sharing of associated IOCs but were determined to release a fourth variant of CryptoWall (CW4) to overcome known malicious characteristics of its predecessor.

Based on the analysis of CW4, CTA researchers found the refreshed malware had similar traits to its predecessor but differed sufficiently to attempt evasion and kept an otherwise similar infrastructure of operation and distribution.

Key Highlights of CW4:

• 15 campaign code identifiers
• 7,194,840 attempted infections
• 36,118 confirmed victims
• Estimated US$18 million in damages

During the period from November 2015 to June 2016, CW4 had reached a total of 7.1 million attempted infections spread across the globe with the largest impact found in North America.