silversurfer

Level 64
Verified
Trusted
Content Creator
Malware Hunter
Threat actors are distributing the Dharma Ransomware in a new spam campaign targeting Windows users in Italy.

The Dharma Ransomware has been active for many years and is based on another ransomware family called Crysis. It is not common, though, to see this ransomware family distributed through malspam as it is more commonly installed via hacked remote desktop services.

Security researchers JAMESWT, TG Soft, and reecDeep all noticed a new spam campaign today that is infecting users with the Ursniff keylogger or the Dharma Ransomware.The spam emails use mail subjects like 'Fattura n. 637 del 14.01.20' and pretend to be a sent invoice.

Spam Email

Spam Email
 

Sampei Nihira

Level 6
Verified
Whoever falls for it is a donkey.
A decree (Decreto) is,
a deliberative or ordinatory act issued by an administrative or judicial authority.
Such as the government, a judge, a prefect.

Certainly not a supplier of a customer.

Furthermore, if we consider the most realistic hypothesis, i.e. that this customer is not a private individual, in Italy apart from a single case (flat-rate accounting) there is the obligation of the electronic invoice sent via PEC or via another platform.
 

Sampei Nihira

Level 6
Verified
Other irregularity.
Usually attachments such as invoice contain the customer's name, the wording invoice n°. ........
Who would open a zip file with a text partially in English ie new instead of "nuovo".

And still who would open an invoice with vbs extension !!!
 

upnorth

Moderator
Verified
Staff member
Malware Hunter
If users and possible even the networks their on is infected, it's a pretty poor comfort as it's too late anyway.

Spam have and always will work to a certain extent either one like it or not and personal I try avoid disparage users. It actually exist better ways.
 

Sampei Nihira

Level 6
Verified
This is not about denigrating users.
It is the article that is poorly written.
No mention of possible spelling mistakes.

Mistakes that would make one suspect that something is wrong.

I only remedied this superficiality, since I'm Italian.
 
  • Applause
Reactions: Correlate
Top