This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LockerGoga Ransomware threat

Hello
 
how to know if SOPHOS (SEC) is actively detecting and blocking the LockerGoga Ransomware threat and its variants
 
Thanks


This thread was automatically locked due to age.
  • Hello daunay olivier,

    questions like this one come up with every new catchy name.
    Beware of names, for one thing there's no standard nomenclature (see here on VirusTotal), names and classifications vary. More important is that these are generic names - there's not just one and only one LockerGoga. And the name might - depending on the vendor - be applied to just the final payload (in all its variants), some or all its precursors at various stages or even an emailing campaign that served as starting point. Thus the question is vague and naturally any answer can also only be vague.

    Nowadays every vendor claims being able to protect against as yet unknown threats. Generally if not both the final payload and the attack sequence are considerably new chances are good that a modern AV security software catches the attack at one point or the other, and the longer some malware family is around the better the detection. Furthermore there's already software (although it's sometimes still an extra) that can mitigate (i.e. undo) the modifications made by ransomware effectively making it void. You might ask why then even larger companies are still hit (and above all in some cases by yet rather simple attacks). Well, more often than not protection is not implemented as it should and could be - for one reason or another. While it's not reassuring that 18 of 71 consider the particular sample as clean it doesn't mean that they wouldn't have stopped the attack before "final delivery".

    I'd assume (I'm not Sophos nor a threat researcher) that there is (already) reasonable protection in the "base" AV, in addition Intercept X not only stops ransomware but mitigates its effects. Still this is not a replacement for adequate backups and proper recovery procedures.

    Christian