EXECUTIVE SUMMARY:
Feint and punch? This ransomware fake-out might mean that your team will have to put up a good fight in order to avoid a flash knockdown…
Microsoft reports an active phishing campaign in which threat actors distribute a computer infection that spreads “fake ransomware”. The ransomware look-a-like involved is in fact trojan malware that can result in a full computer takeover.
In Windows systems, this malware offers hackers an easy backdoor entry point. Once in the system, passwords and other credentials can be harvested from both email clients and web browsers. The roster of user platforms at risk of compromise include Outlook, Internet Explorer, Firefox and Chrome.
The email campaign
First, emails purporting to contain payment-related information arrive in users’ inboxes. Then, users who open the emails and click on the attachment are immediately connected to a malicious domain. Ultimately, this leads to the download of the Java-based STRRAT malware.
This malware not only collects passwords, it can also log keystrokes, run remote commands and PowerShell and more. If so desired, hackers can usurp full control over infected computers. Victims and their files remain at the mercy of hackers.
Updated malware
The STRAAT threat has persisted for more than a year. Since the launch of the campaign, attackers have launched a beta version of their malware trojan. The latest malware is “notably more obfuscated and modular than previous versions,” say researchers.
In an effort to disguise the attack as a ransomware scheme, the malware includes a .crimson file name extension. Nonetheless, in the wake of the attack, users’ files are not actually encrypted.
Why the .crimson?
Cyber attackers aim to dupe victims with this. It could reflect an attempt to obscure the fact that a remote access trojan now lives on the computer.
As the STRRAT malware continues to make its way around the web, this phishing campaign may continue to evolve. These hackers are committed to their endeavors. Will hackers manipulate email accounts owned by victims in an effort to further disseminate the malware?
Avoiding this phishing attack
While anti-phishing software can protect systems, several other tactics may also prove worthy of pursuit in dodging this fake ransomware threat.
- IT teams can inform employees to remain wary of unexpected messages, especially those mentioning monetary gain.
- Organizations can advise caution in regards to opening emails from unknown email senders.
- Phishing training isn’t a one-and-done deal. Consider offering flexible, regular workshops regarding phishing.
For more on fake ransomware and ransomware fake-outs, visit ZDNet.