- Jun 9, 2013
- 6,720
Cisco’s Talos team spotted 137,731 emails in just four days, containing over 3300 unique samples, according to technical lead, Warren Mercer.
Most of the emails used simple social engineering, asking the user to look at an attached document they had ‘requested.'
Emails are also crafted to appear more convincing by greeting the recipient by first name, he explained.
Once opened, the malicious JavaScript will run in the background, encrypting all files on a user’s machine with the .zepto extension.
Some samples only contacted one C&C server whilst others communicated with up to nine domains, the researcher continued.
Once the encryption has been done, the malware will display a message for the victim, demanding payment.
“The email attack vector will continue to be used as email is an everyday occurrence now and the ability to generate large lists of emails for spam campaigns like this is growing easier. The breaches which occur include email data which is actively sold to bidders on the underground for this type of campaign,” said Mercer.
“Ensuring users are careful with email attachments, like the ones used in this campaign, will help in an attempt to null the effects of this and further spam campaigns. Talos recommend you ensure you have a good backup strategy should you be hit with ransomware and we strongly advise that payment is never made to these actors.”
Read More. Zepto Ransomware Soars
Most of the emails used simple social engineering, asking the user to look at an attached document they had ‘requested.'
Emails are also crafted to appear more convincing by greeting the recipient by first name, he explained.
Once opened, the malicious JavaScript will run in the background, encrypting all files on a user’s machine with the .zepto extension.
Some samples only contacted one C&C server whilst others communicated with up to nine domains, the researcher continued.
Once the encryption has been done, the malware will display a message for the victim, demanding payment.
“The email attack vector will continue to be used as email is an everyday occurrence now and the ability to generate large lists of emails for spam campaigns like this is growing easier. The breaches which occur include email data which is actively sold to bidders on the underground for this type of campaign,” said Mercer.
“Ensuring users are careful with email attachments, like the ones used in this campaign, will help in an attempt to null the effects of this and further spam campaigns. Talos recommend you ensure you have a good backup strategy should you be hit with ransomware and we strongly advise that payment is never made to these actors.”
Read More. Zepto Ransomware Soars
