In a move to obfuscate network traffic more effectively, Locky ransomware developers have recently upgraded the malware to communicate with its command and control server via both symmetric and asymmetric encryption, as opposed to custom encoding.
FireEye Labs, the research division of FireEye, detailed this new development in Locky's evolution in a blog post. While observing recent samples of the malware, FireEye found that when Locky contacts the control server to obtain a public key for encrypting a victim's files, Locky initially generates AES (Advanced Encryption Standard) keys and encrypts its plain text request, and then subsequently encrypts the AES keys.
“Locky has moved from using simple encoding to obfuscate its network traffic to a complex encryption algorithm using hardware instructions that are very hard to crack,” the researchers wrote.