As added impetus for Internet security firms, another major ransomware attack is giving rise to concerns about current security strategies. As yet, numbers of affected users is not available, but the attack is believed to be far-reaching. Email accounts were phished with a bogus email purportedly from Amazon.com. Comodo Threat Research Labs (CTRL) detected the attack Tuesday and is alerting the public to the threat.
Phishing emails have been sent to users supposedly originating from Amazon.com, with the sender email [email protected]. Reportedly, there is no body to the email, but the subject of the email is “Your Amazon.com order has dispatched (#code).” The components that do the damage are the attachments, which are included as Microsoft Word documents.
When the documents were analyzed, it was determined there was no copy, only macro codes. Unsuspecting recipients are prompted to enable the contents of the documents so that the macro codes are then executed. This allows an executable file to be downloaded from the Internet and then to run. The file, now running, has been identified as ransomware which searches for and encrypts user files, including documents, pictures, audio files, database files and more. During this process, original files are deleted and replaced with the encrypted files named “%hashvariable%locky,” in the same folders as the original files.
And how do the cybercriminals profit from this? Because ransomware has now been installed, user data is held hostage. Encrypted files generate bmp files which include warnings and instructions for the user to pay ransom to recover original files. Users are told how they can pay ransom, and these warnings and instructions are set as the desktop background. In addition, an html file with the same warnings and instructions is inserted in every folder that now contains encrypted files.
This latest attack only increases the call to action to strengthen security measures. Cybercriminals adapt to attempts to block them, constantly creating new and more insidious strains of malware. There are solutions available which have been proven to fend off even the most persistent strains; Comodo has a wide variety of solutions that can be tailor-made for enterprises large and small.
