Contract ID 95669 has been terminated – JS malware leads to Teslacrypt

Last revised or Updated on: 23rd March, 2016, 2:18 PMAn email with the subject of  Contract ID 95669 has been terminated [ random numbered]  pretending to come from random names and senders  with a zip attachment is another one from the current bot runs which downloads Teslacrypt ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: Random names and email addresses Date: Wed 23/03/2016 13:07 Subject: Contract ID 95669 has been terminated Attachment: confirm_87844607.zip Body content: Dear Customer,   We … Continue reading →