Banking trojan DanaBot, which is known to target organizations across Europe, North America, and Australia, has been found being distributed with a ransomware module. Security researchers from CheckPoint came across this new variant in few of the recent DanaBot campaigns. According to the researchers, DanaBot also had new plugins, configuration files, string encryptions, file name generation algorithms as well as had a different communication protocol.
CheckPoint researchers hint that the threat actors behind DanaBot continue to keep updating the trojan. “For almost a year, DanaBot has been extending its capabilities and evolving into a more sophisticated threat. We assume its operators will continue to add more improvements,” they said.
“A lot of ransomware still remain a relatively stable source of income for cybercriminals. Therefore such simple 'copy-paste' encryptors as the one that was described here will continue to emerge constantly,” the researchers wrote, regarding the prevalence of ransomware attacks.