New phishing campaign packs an info-stealer, ransomware punch

guest · May 1, 2020

New phishing campaign packs an info-stealer, ransomware punch
May 1, 2020
https://www.bleepingcomputer.com/ne...paign-packs-an-info-stealer-ransomware-punch/

A new phishing campaign is distributing a double-punch of a LokiBot information-stealing malware along with a second payload in the form of the Jigsaw Ransomware.

By using this malware combo, the attackers first steal saved user names and passwords stored in a variety of applications and then deploy the Jigsaw Ransomware to try and get a small ransom to sweeten the attack.
Weaponized Excel spreadsheets
The exact emails sent as part of this campaign have not been found, but the attachments impersonate invoices, bank transfers, orders, and business inquiries.

According to security researcher James, who discovered this campaign, these attachments have been weaponized using LCG Kit so that they exploit an old Microsoft Office CVE-2017-11882 remote code execution vulnerability in Equation Editor.
Click to expand...

Additional ransomware payload
In addition, this LokiBot variant has been configured to download and install a Jigsaw Ransomware variant that uses a Salvadore Dali mask from the popular Money Heist show as its background.
The good news is that Jigsaw is easily decrypted, so if you become infected with this variant, be sure to let us know so we can help.
Click to expand...

Log in or Sign up

New phishing campaign packs an info-stealer, ransomware punch

guest Guest

Log in or Sign up

New phishing campaign packs an info-stealer, ransomware punch

guest Guest

Useful Searches