Collaborate Disseminate
An email with the subject of documents pretending to come from random senders with a malicious word doc or Excel XLS spreadsheet attachment delivers an unknown malware ( probably Ursnif / Gozi / ISFB but some suggest nymaim ) I especially like the domain name for this malspam delivery http://cautiousvirus.com/mbtrf.exe which … Continue reading → Continue reading documents malspam delivers unknown malware
We do see a few almost believable 419 ( advance fee fraud) scams from time to time. This even more laughable attempt than yesterday’s version definitely isn’t one! The scammer only want $525 as a special one time only custom clearance charge. I never knew the FBI director used a Japanese … Continue reading → Continue reading fake FBI director $9.5m USD 419 scam
We do see some almost believable 419 scams from time to time. This laughable attempt definitely isn’t one! The scammer only want $100 as a procurement fee, but with the number of so called banks and organisations involved, it is hard to say what he is trying to persuade you … Continue reading → Continue reading Another laughable 419 scam
Continuing with the never ending series of malware downloaders is an email with the subject of DHL Tracking Number for shipment 97 93745 186 ( random numbers) pretending to come from DHL Corporation with a link in email body to download a file that will deliver what looks like ransomware I had a … Continue reading → Continue reading fake DHL Tracking Number for shipment malspam delivers ransomware
Continuing with the latest series of emails with pdf attachments that drops a malicious macro enabled word doc is an email with various subjects along the line of receipt, payment, payment receipt etc ( random numbers) pretending to come from donotreply@ random email addresses and companies that delivers Jaff ransomware They are … Continue reading → Continue reading more jaff ransomware delivered via fake receipts or payments emails
Back to RTF files this time using the CVE-2017-0199 vulnerability that was fixed in April 2017 and again extra added protections by the May 2017 security updates. If you haven’t got round to applying these essential patches yet, then go & do it NOW!!!! The malware payload is the same … Continue reading → Continue reading fake bookatable.com and efaxcorporatexx.top malspam using CVE-2017-0199 exploits to deliver malware
Getting several different Italian Language malspam emails with various subjects pretending to come from various Italian email addresses with zip attachments that contain a malicious macro enabled word doc that delivers Zeus Panda They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. … Continue reading → Continue reading Italian language zeus panda from macro word docs inside zips
An email with the subject of FW: Case C238260756 message pretending to come from Companies House but actually coming from a look alike domain WebFiling@companieshousewebfilling.co.uk with a malicious attachment is today’s latest spoof of a well known company, bank or public authority delivering some sort of malware This is Trickbot banking Trojan. … Continue reading → Continue reading Spoofed Companies House FW: Case C238260756 delivers unknown malware
Continuing with the latest series of emails with pdf attachments that drops a malicious macro enabled word doc is an email with the subject of 43412591 ( random numbers) pretending to come from noreply@ random companies that delivers Jaff ransomware They are using email addresses and subjects that will scare or entice … Continue reading → Continue reading Copy of Invoice1234567 coming from noreply@ delivers jaff ransomware
An empty blank email with no subject pretending to come from jhavens@mt.gov with a zip file that contains malicious word doc with an embedded OLE object delivers GlobeImposter 2.0 ransomware They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very … Continue reading → Continue reading blank email with zip attachment containing a word doc with OLE embedded js delivers GlobeImposter 2.0 ransomware