Meet the Rombertik, the malware that self-destructs when discovered

Hard to believe that a malware can cause so much havoc.
Hard to believe that a malware can cause so much havoc.

Researchers at the Cisco-owned Talos Security Intelligence and Research Group have discovered a piece of malware, named Rombertik, that can best be described as exhibiting kleptomaniac and suicidal behaviours.

Ben Baker and Alex Chiu, who were part of the team that unearthed Rombertik, found out that this malware lives on the victim's browser, in a way similar to a parasite, and exfiltrates login details and other sensitive piece of information to an external server.

The data capture occurs at the source itself, i.e. as the target enters it in the browser, before the information is encrypted and sent over HTTPS.

While its propagation methods remains remarkably simple, relying mostly on social engineering and the gullibility of the weakest link in the system (i.e. human beings), it is what follows afterwards that makes it interesting.

"If the sample detected that it was being analysed or debugged it would ultimately destroy the master boot record [MBR]" wrote the pair.

A nasty piece of bits

Doing so just makes your computer unusable forcing you to reinstall your operating system altogether. If the malware doesn't have the permission do that, it will encrypt the home folder and restart your computer.

That is not a new behaviour remarked David Emm, Principal Security Researcher at Kaspersky Lab. ""Trashing sections of a hard disk, or corrupting data was quite common in the 1990s - that was a time when the threat landscape was dominated by cyber-vandalism e.g. Michelangelo, Dark Avenger, Maltese Amoeba, Chernobyl. Equally, it's an approach that has been employed more recently by 'wipers' (e.g. Shamoon) to sabotage infected systems. Likewise, encrypting data, while used in 'old school' attacks for mischief (e.g. One-half) has become a key feature in today's ransomware programs."

Making sure that your antivirus software is installed and up to date, that you don't click on suspicious attachments and block certain types will go a long way to protect yourself.

Source: Cisco's Talos

TOPICS
Desire Athow
Managing Editor, TechRadar Pro

Désiré has been musing and writing about technology during a career spanning four decades. He dabbled in website builders and web hosting when DHTML and frames were in vogue and started narrating about the impact of technology on society just before the start of the Y2K hysteria at the turn of the last millennium.

Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Ray-Ban Meta Smart Glasses
Samsung's rumored smart specs may be launching before the end of 2025
Apple iPhone 16 Review
The latest iPhone 18 leak hints at a major chipset upgrade for all four models
Quordle on a smartphone held in a hand
Quordle hints and answers for Monday, March 24 (game #1155)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Monday, March 24 (game #386)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Monday, March 24 (game #652)
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)