Trend Micro Incorporated : Examining the Cring Ransomware Techniques

The Cringransomwaremade headlines as the threat was used in an attack thatexploited a bugin the 11-year-old version of the Adobe ColdFusion 9 software.

This has been the first recorded incident involving Cring operators’ use of the said vulnerability. Past Cring attacks either abused unsecure remote desktop protocol (RDP) or virtual private network (VPN)vulnerabilitiesto gain initial access.

Ransom.Win32.CRING.Cis our detection name for the executable, whileRansom.MSIL.CRYNG.Ais the detection name that is used to detect C#-based samples for the same ransomware.

In this entry, we look at the techniques typically employed by this ransomware, as well as the most affected regions and industries.

The Cring ransomware…