A new variant of ransomware known as Locky (detected by Symantec as Trojan.Cryptolocker.AF) has been spreading quickly since it
first appeared on Tuesday (February 16). The attackers behind Locky have pushed
the malware aggressively, using massive spam campaigns and compromised
websites.
Locky encrypts files on victims’ computers and adds a
.locky file extension to them. The ransom demand varies between 0.5 to 1
bitcoin (approximately US$210 to $420).
One of the main routes of infection has been through spam email campaigns, many of which are disguised
as invoices. Word
documents containing a malicious macro are attached to these emails.
Symantec detects these malicious attachments as W97M.Downloader. If this macro is allowed to run, it will
install Locky onto the victim’s computer.
Symantec telemetry indicates that Locky was spread by at least five
different spam campaigns on February 16. Most of the spam emails seen had a
subject line that read “ATTN: Invoice J-[RANDOM NUMBERS]”. Another campaign
used “tracking documents” as a subject line.
The spam campaigns spreading Locky are operating on a massive scale.
Symantec anti-spam systems blocked more than 5 million emails associated with
these campaigns
Comments
Post a Comment