Author Archives: Myonlinesecurity

your latest electronic invoice from D.E. Web Works – word doc rtf macro malware

Posted on by

Last revised or Updated on: 23rd March, 2016, 12:59 PMFollowing on from this malspam run yesterday is today’s similar run with  emails with the same subjects  pretending to be your latest electronic invoice from D.E. Web Works   with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. D.E. … Continue reading → Continue reading your latest electronic invoice from D.E. Web Works – word doc rtf macro malware→

FW: Order RF#535656 – js malware leading to Locky ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 8:41 PMAn email with the subject of  FW: Order RF#535656 [ random numbered]  pretending to come from random names and email addresses  with a zip attachment is another one from the current bot runs which downloads Locky Ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The name of the alleged sender ( who isn’t sending them ) matches the name in the body of the email. The attachment name is created by using  part of the recipients … Continue reading → Continue reading FW: Order RF#535656 – js malware leading to Locky ransomware→

Voicemail from 07730881627 00:00:24 SureVoIP – JS malware leads to #Locky ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 8:18 PMAn email with the subject of  Voicemail from 07730881627 <07730881627> 00:00:24 pretending to come from SureVoIP <voicemailandfax@surevoip.com>  with a zip attachment is another one from the current bot runs which downloads Locky Ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: SureVoIP <voicemailandfax@surevoip.com> Date: Subject: Voicemail from 07730881627 <07730881627> 00:00:24 Attachment: Body content: Message From “07730881627” 07730881627 Created: Tue, 22 Mar 2016 23:00:09 +0300 Duration: 00:00:24 Account: 9995@123carfinance.hosted.surevoip.com   Screenshot:   These malicious … Continue reading → Continue reading Voicemail from 07730881627 00:00:24 SureVoIP – JS malware leads to #Locky ransomware→

Message from KMBT_C224 pretending to come from copier at your own domain – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 6:32 PMAn empty / blank email with the subject of Message from KMBT_C224 pretending to come from copier at your own domain  with a zip attachment is another one from the current bot runs which downloads Locky Ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: copier@victimdomain.tld Date: Tue 22/03/2016 18:07 Subject: Message from KMBT_C224 Attachment: SKMBT_C4335050508359.zip Body content: totally blank   Screenshot:   These malicious attachments normally have a password stealing component, with … Continue reading → Continue reading Message from KMBT_C224 pretending to come from copier at your own domain – JS malware leads to Locky ransomware→

Urgent: F184255 SAFESTORE HLDGS PLC/ HPE STRAN Technologies – word doc macro malware leads to #Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 4:44 PMFollowing on from THIS malspam run this morning with almost identical subjects is an email with the subject of Urgent: F184255 SAFESTORE HLDGS PLC/ HPE pretending to come from random names and email addresses  with a malicious word .doc and an .RTF  attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better … Continue reading → Continue reading Urgent: F184255 SAFESTORE HLDGS PLC/ HPE STRAN Technologies – word doc macro malware leads to #Dridex→

Re-activate your Online Banking – NatWest bank phishing

Posted on by

Last revised or Updated on: 22nd March, 2016, 3:09 PMThere are a few major common subjects in a phishing attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like : Urgent: Your card has been stopped ! There have been unauthorised or suspicious attempts to log in to your account, please verify Your account has exceeded its limit and needs to be verified Your account will be suspended ! You have received a secure message from < your bank> We are unable to verify your account information Update Personal Information Urgent Account Review Notification We recently noticed one or more attempts to log in to your PayPal account from a … Continue reading → Continue reading Re-activate your Online Banking – NatWest bank phishing→

You are being accused with bodily injury (Case: 02172723) – JS malware leads to #ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 2:24 PMAn email with the subject of  You are being accused with bodily injury (Case: 02172723) [ random numbered]  coming from random names and email addresses  with a zip attachment is another one from the current bot runs which downloads what looks like Teslacrypt ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: random names & email addresses Date: Tue 22/03/2016 12:19 Subject: You are being accused with bodily injury (Case: 02172723) Attachment: … Continue reading → Continue reading You are being accused with bodily injury (Case: 02172723) – JS malware leads to #ransomware→

Hewlett Packard Enterprises random company names Urgent document – word RTF macro malware leads to Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 11:00 AMAn email that appears to come from HP ( Hewlett Packard Enterprises) with the subject of Urgent: F400572 HARGREAVES LANSDOWN PLC/ HPE coming from random names and email addresses   with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers … Continue reading → Continue reading Hewlett Packard Enterprises random company names Urgent document – word RTF macro malware leads to Dridex→

random statements from random senders – JS malware leads to Locky Ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 10:29 AMAn email with the subject of  FW: Statement S#327763 [ random numbered]  pretending to come from random names and email addresses  with a zip attachment is another one from the current bot runs which downloads Locky Ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The name of the alleged sender ( who isn’t sending them ) matches the name in the body of the email. The attachment name is created by using  part of the recipients … Continue reading → Continue reading random statements from random senders – JS malware leads to Locky Ransomware→

Blank 2 Steve Gale – word macro malware leads to #Dridex

Posted on by

Last revised or Updated on: 22nd March, 2016, 9:34 AMAn email with a completely blank / empty body with the subject of  Blank 2 pretending to come from Steve Gale <steve1gales@gmail.com>  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Steve Gale or … Continue reading → Continue reading Blank 2 Steve Gale – word macro malware leads to #Dridex→