Dharma Ransomware Attacks Italy in New Spam Campaign

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/dharma-ransomware-attacks-italy-in-new-spam-campaign/

Threat actors are distributing the Dharma Ransomware in a new spam campaign targeting Windows users in Italy.

The Dharma Ransomware has been active for many years and is based on another ransomware family called Crysis. It is not common, though, to see this ransomware family distributed through malspam as it is more commonly installed via hacked remote desktop services.

Security researchers JAMESWT, TG Soft, and reecDeep all noticed a new spam campaign today that is infecting users with the Ursniff keylogger or the Dharma Ransomware.The spam emails use mail subjects like 'Fattura n. 637 del 14.01.20' and pretend to be a sent invoice.

Spam Email​

 

[Sampei Nihira]

Whoever falls for it is a donkey.
A decree (Decreto) is,
a deliberative or ordinatory act issued by an administrative or judicial authority.
Such as the government, a judge, a prefect.

Certainly not a supplier of a customer.

Furthermore, if we consider the most realistic hypothesis, i.e. that this customer is not a private individual, in Italy apart from a single case (flat-rate accounting) there is the obligation of the electronic invoice sent via PEC or via another platform.

 

[Outpost]

@Sampei Nihira

Don't be surprised. At least half (if not more) of the people I deal with would not think twice about opening the attachment.

 

[Sampei Nihira]

Other irregularity.
Usually attachments such as invoice contain the customer's name, the wording invoice n°. ........
Who would open a zip file with a text partially in English ie new instead of "nuovo".

And still who would open an invoice with vbs extension !!!

 

[upnorth]

If users and possible even the networks their on is infected, it's a pretty poor comfort as it's too late anyway.

Spam have and always will work to a certain extent either one like it or not and personal I try avoid disparage users. It actually exist better ways.

 

[Sampei Nihira]

This is not about denigrating users.
It is the article that is poorly written.
No mention of possible spelling mistakes.

Mistakes that would make one suspect that something is wrong.

I only remedied this superficiality, since I'm Italian.