Net hit by Ransomware attack first seen in 2008

[Schlup]

Attack made up more than half of malware in Feb

Cybercriminals have once again hit the web with a ransomware campaign that was first used in 2008, says Fortinet.

According to the security firm, in the space of only two days, 8 and 9 February, the HTML/Goldun.AXT campaign accounted for more than half the total malware detected for February, which gives some indication of its unusual scale.

The attack itself takes the form of a spam email with an attachment, report.zip, which if clicked automatically downloads a rogue anti-virus product called Security Tool.

It is also being distributed using manipulated search engine optimisation (SEO) on Google and other providers.

Such scams have been common on the internet for more than a year, but this particular one features a more recently-evolved sting in the tail.

The product doesn't just ask the infected user to buy a useless licence in the mode of scareware, it locks applications and data on the PC, offering access only when a payment has been made through the single functioning application left, Internet Explorer.

What's new, then, is that old-style scareware has turned into a default ransom-oriented approach. The former assumes that users won't know they are being scammed, while the latter assumes they will but won't know what to do about it.

The technique is slowly becoming more common - see the Vundo attack of a year ago - but what is also different is the size of this attack, one of the largest ever seen by Fortinet for a single malware campaign.

Fortinet notes that Security Tool is really a reheat of an old campaign from November 2008, which pushed the notorious rogue antivirus product Total Security as a way of infecting users with a keylogging Trojan.

"This is a great example of how tried and true attack techniques/social engineering can be recycled into future attacks," says Fortinet's analysis.

According to Fortinet, the 'engine' pushing the spike in ransom-based malware is believed to be the highly-resilient Cutwail/Pushdo botnet, the same spam and DDoS system behind a number of campaigns in the last three years including the recent pestering of PayPal and Twitter sites.

[cygnus]

My girlfriend had this on her PC last month....took me a a bit of tinkering to get rid of it too.  Sometimes I wonder if it isn't the virus companies distributing these files.   :

[Malhovic]

The main thing that gets me is that standard Anti-Virus applications don't catch these things. You have to run Anti-Malware Applications in order to. I hate people that do this stuff...man up and get a real job.

[Schlup]

LOL...this is kinda a good thing for my new business...

[Monkey_Grill]

Failtards come in everyday at work with these types of viruses. Such noobs!

[cygnus]

The main thing that gets me is that standard Anti-Virus applications don't catch these things. You have to run Anti-Malware Applications in order to. I hate people that do this stuff...man up and get a real job.

Yep and even the malware programs don't pick it up half the time.  I really do not understand why anyone would find it amusing.....and they already have a job - at Symantec!