This ransomware targets HR departments with fake job applications

Cybercriminals are posing as job applicants as part of a new campaign to infect victims in corporate human resources departments with GoldenEye ransomware -- and they're even providing covering letters in an effort to lull targets into a false sense of security.

A variant of the Petya ransomware, GoldenEye targets human resources departments in an effort to exploit the fact that HR employees must often open emails and attachments from unknown sources.

Cybersecurity researchers at Check Point have been monitoring the campaign, which attempts to deliver ransomware to German targets using emails and attachments claiming to be from job applicants. The initial email contains a short message from the fake applicant, directing the victim to two attachments.

The first is a covering letter within a PDF which doesn't actually contain any malicious software, but is intended to reassure the target that they're dealing with a standard job application. However, the second attachment is an Excel file supposedly containing an application form but which in fact contains the malicious GoldenEye payload.

Upon opening the Excel attachment, the target is presented with a document which claims to be 'Loading' and requires them to enable Macros to view the file. When Macros are enabled, GoldenEye executes a code and begins encrypting the users' files before presenting them with a ransom note using yellow text -- rather than the red or green used by other Petya variants.

goldeneye ransomware note 050120171538

The note demands the victim pays a ransom of 1.3 bitcoins - around $1,000 - in order to retrieve their files. Much like other increasingly professional ransomware and cybercriminal campaigns, the perpetrators detail how the victim can acquire bitcoin on the dark web and even offer the option of exchanging messages with a GoldenEye admin if they're having trouble with the payment or decryption process.

It's believed by researchers that the developer behind Petya ransomware is going by the alias Janus -- apparently borrowing the name of a cybercrminal group in the 1995 James Bond film GoldenEye.

The cybercriminal operation behind the GoldenEye campaign has also been known to offer ransomware-as-a-service schemes which allow almost any wannabe hacker to cash-in on cyber extortion.

One way users can avoid falling victim to GoldenEye and other ransomware variants is by never enabling Macros within Microsoft Office documents and being mindful of unexpected or overly generic email messages.

 

 

Source: zdnet.com

 

Last modified on 05/01/2017

Share this article

About Author

Samer Hmouda

I was Borne and raised in Kuwait, I take my degree in low from Lebanese university in 1994.

Technology is my passion so I read and teach myself a lot of things related to networking and technology. Internet was one of the most help tools in my learning. I watch many videos and learn from many articles which I read on the web, so now I will try to help others same as I got help from others without waiting for any thanks.

Samer H.

Website: www.middnet.net/
Leave a comment

Make sure you enter all the required information, indicated by an asterisk (*). HTML code is not allowed.

About us

Middle East Network "middnet.net" is not responsible for the content of external sites.

 

For your Advertise, call us on:
+961 3 247 341
+961 788 70 6 70

Last posts

Newsletter

Join our Newsletter for latest news and update about technology, phones, software, hardware and security.
Receive