WastedLocker Ransomware: Analysis and Demonstration of the threat that cost Garmin millions

TL;DR

Garmin's servers were taken down for several weeks due to a targeted ransomware attack called Wasted Locker, which uses strong encryption methods and demands high ransom payments.

Transcript

hello and welcome to the pc security channel today we'll be taking a look at wasted locker the ransomware that took down garmin servers for a substantial amount of time so if you've been having syncing issues with your garmin smartwatch well now you know what's to blame some of you may have heard of the news already it happened a couple of weeks ag... Read More

Key Insights

• 👊 Wasted Locker is a targeted ransomware attack that took down Garmin's servers, causing disruptions to their services.
• 😒 The ransomware uses strong encryption methods, making data recovery without paying the ransom nearly impossible.
• 👤 Wasted Locker does not employ common tactics like changing desktop backgrounds or displaying ransom messages, making it difficult for users to realize their files have been encrypted.
• 💯 The ransom demand for Wasted Locker can increase from hundreds of thousands of dollars to several millions, depending on the target.
• 👊 Proactive protection, including regular backups, is crucial to mitigate the risk of falling victim to ransomware attacks.
• 👊 Wasted Locker demonstrates the shift towards financially motivated ransomware attacks rather than amateurish attempts.
• 👤 Users should take cyber security seriously, as one instance of ransomware infection can have detrimental consequences.

Questions & Answers

Q: How did the Wasted Locker ransomware target Garmin's servers specifically?

Wasted Locker is a targeted ransomware attack that was specifically designed for Garmin's servers, indicating that the attackers had prior access to the system.

Q: Can Wasted Locker be detected by antivirus engines?

While most antivirus engines can detect Wasted Locker, there are some that may not have blacklisted it yet, such as Komodo and ClamAV.

Q: How does Wasted Locker hide its malicious activities?

Wasted Locker obfuscates its code to make it difficult to extract metadata. However, patterns and suspicious strings can still be used for detection.

Q: How does Wasted Locker encrypt files and demand ransom?

Wasted Locker encrypts files on the system, adding the "garmin wasted" extension. It then creates an info file containing the ransom message and demands a high ransom payment.

Summary & Key Takeaways

• Garmin's servers were affected by the Wasted Locker ransomware, causing syncing issues with smartwatches and disruption to email and chat systems.

• Wasted Locker uses AES and RSA encryption, making it virtually impossible to decrypt the files without paying the ransom.

• The ransom demand for Wasted Locker starts at hundreds of thousands of dollars and can increase to several millions.