An Unusual Tip To Avoid Russian Malware

The health service in Ireland has been suffering major disruptions due to a ransomware attack last week. I was listening to a podcast about the attack and the lessons to be learned from it where Ronan Murphy, the chief executive of Smarttech 247 went through the details what was going on.

It was a good introduction into the issue and just how much damage an attack like this can do and how long it can take to fix. Towards the end of the interview he dropped a pro tip that I hadn't heard before.

The tip was to install a Cyrillic keyboard on your computer because some ransomware programs look to see if a Cyrillic keyboard is installed and will not run if it is. I thought this sounds too easy to be effective but I found other security professionals have also mentioned it.

Cybereason published a really interesting analysis of DarkSide's ransomware which was involved in the attack on the Colonial pipeline in the US. They found that DarkSide had a hardcoded list of languages where the malware will check if they are present in the system. If they are then the malware will not be installed.

Evidently, this is a common check for numerous malware strains. As far as I know this works on Microsoft Windows. I don't know about other operating systems.

This does not mean you can avoid performing other computer hygiene tasks like avoiding risky behaviour online, backing up your data regularly, using different passwords for different websites, keeping your software up to date, etc. Plus this will only work for malware developed in or around Russia and Eastern Europe.

There doesn't seem to be a major downside to installing one of these languages if you're running Microsoft Windows on a machine.

The security landscape is always shifting and this will change at some point. If someone like me is talking about it then I assume malware will evolve soon if it hasn't done so already.

How to add a new language in Windows 10

Search for language settings in the Winbdows menu

Click on Add a language

Search for the language you want to install

Select your language and check any other features you may wish to install with it and then click Install