Author Archives: Myonlinesecurity

Multiple email subjects delivering Locky ransomware

Posted on by

Last revised or Updated on: 30th March, 2016, 2:31 PMwe are seeing a whole series of different email subjects and body contents  coming from random senders downloading Locky ransomware from multiple places today They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Most of these are using such generic subjects that somebody must be expecting an email about that sort of thing so are likely to open it without really thinking. Some of the subjects include FW:Expenses Report # 109681 – 03/2016 payment confirmation Additional … Continue reading → Continue reading Multiple email subjects delivering Locky ransomware→

More emails that pretend to come from a scanner, printer or multifunctional device at your own email domain – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 30th March, 2016, 1:53 PMYet another series of emails that pretend to be coming from a scanner, printer or multifunctional device at your own email domain with a zip attachment is another one from the current bot runs which downloads They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. In exactly the same way as one of yesterday’s malspam runs the subjects pretend to be emailing an image or document file Some of the subjects seen today include: Emailing: FILE-57146596.tiff Emailing: … Continue reading → Continue reading More emails that pretend to come from a scanner, printer or multifunctional device at your own email domain – JS malware leads to Locky ransomware→

Delivery Confirmation Receipt – Tracking #529F84634 – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 29th March, 2016, 3:46 PMAn email with the subject of  Delivery Confirmation Receipt – Tracking #529F84634 [ random numbered]  pretending to come from random email addresses  with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. One of the emails looks like: From: Wally cruix/cruik <cruix/cruikWally51@woonpalace-boelhouwers.nl> Date: Tue 29/03/2016 15:36 Subject: Delivery Confirmation Receipt – Tracking #529F84634 Attachment: ans_invoices_417835.zip Body content: Your parcel has been delivered at … Continue reading → Continue reading Delivery Confirmation Receipt – Tracking #529F84634 – JS malware leads to Locky ransomware→

scanned document Tara Savill Charisma Bathrooms Limited – word doc macro malware

Posted on by

Last revised or Updated on: 29th March, 2016, 3:21 PMAn email with the subject of  pretending to come from Tara Savill <tara@charismabathrooms.com> with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Tara Savill  and Charisma Bathrooms Limited have not been hacked or had their … Continue reading → Continue reading scanned document Tara Savill Charisma Bathrooms Limited – word doc macro malware→

Locky ransomware downloads hijacked by vigilante and delivering Eicar test file instead

Posted on by

Last revised or Updated on: 29th March, 2016, 4:43 PMAnother set of  empty /blank emails that pretend to come from your own email address. This particular bunch have multiple subjects but all starting with CCE29032016  and attachments that also start with CCE29032016 Some of the subjects and attachments I have seen include: CCE29032016_00095.jpg CCE29032016_00065.docx  CCE29032016_00067.tiff CCE29032016_00050.pdf CCE29032016_00002.gif   These are obviously designed to make you think they are coming from a printer, scanner or Multi-functional device on your network. They are not image or word files despite the extensions and icons saying they are These attachments are not what they appear to be and are actually renamed zip files with the icons of the files they pretend to be, containing a js file. … Continue reading → Continue reading Locky ransomware downloads hijacked by vigilante and delivering Eicar test file instead→

EUROPOWER INVOICES – word doc macro malware

Posted on by

Last revised or Updated on: 29th March, 2016, 10:55 AMAn email with the subject of EUROPOWER INVOICES  pretending to come from Europower Electrical <admin@europower-electrical.com> with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Europower Electrical  has not been hacked or had their email or … Continue reading → Continue reading EUROPOWER INVOICES – word doc macro malware→

Credit Card Has Been Declined *9764 – JS malware

Posted on by

Last revised or Updated on: 29th March, 2016, 10:32 AMAn email with the subject of  Credit Card Has Been Declined *9764[ random numbered]  pretending to come from random senders  with a zip attachment is another one from the current bot runs which downloads what looks like it is supposed to be  locky ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: Shirley brackenbury <brackenburyShirley12280@covertech.com.br> Date: Tue 29/03/2016 10:03 Subject: Credit Card Has Been Declined *9764 Attachment: copy_ellie_631312.zip Body content: Your credit card … Continue reading → Continue reading Credit Card Has Been Declined *9764 – JS malware→

Emerson Sherman. Payment – word doc macro malware

Posted on by

Last revised or Updated on: 29th March, 2016, 9:22 AMAn email with the subject of [random name] payment / invoice / report / message /Transaction  pretending to come from  the same random name but a totally different email address  with a random numbered malicious word doc attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from … Continue reading → Continue reading Emerson Sherman. Payment – word doc macro malware→

random company invoice – word doc macro malware

Posted on by

Last revised or Updated on: 28th March, 2016, 4:30 PMAn email with the subject of [random company name] invoice – [recipient domain]  pretending to come from random senders  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. This series of malspam emails has a … Continue reading → Continue reading random company invoice – word doc macro malware→

Document (1).pdf pretending to come from netadmin nadiam1pa@your email domain – JS malware leads to ransomware

Posted on by

Last revised or Updated on: 28th March, 2016, 3:00 PMAn email that tries to make you think it is coming from your own email domain / company   with the subject of  Document (1).pdf   pretending to come from netadmin <nadiam1pa@your email domain.tld>  with a zip attachment is another one from the current bot runs which downloads some sort of ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: netadmin <nadiam1pa@your email domain.tld> Date: Document (1).pdf Subject: Document (1).pdf Attachment: Document (1).zip Body … Continue reading → Continue reading Document (1).pdf pretending to come from netadmin nadiam1pa@your email domain – JS malware leads to ransomware→