CKA Forums
Login 
canadian forums
bottom
 
 
Canadian Forums

Author Topic Options
Offline
CKA Moderator
CKA Moderator
 Vancouver Canucks


GROUP_AVATAR
User avatar
Profile
Posts: 63946
PostPosted: Thu Sep 07, 2017 7:59 am
 


Yup, our friend Locky is back and this time it comes with a delay feature.

The damned thing comes in on a Microsoft Word document that downloads the software when the recipient opens the document. Then it executes when the user exits the document...which for right now is bypassing most anti-virus programs.

If you enable macros on these documents then you're in deep shit. Best advice is to not enable macros on any Word document and then expect the criminals to pivot to Excel during this campaign.

The signature emails pose as innocent scanner messages saying things like "Scanned Image from HP LaserJet 4000" and etc.

The primary countries for these attacks are Turkey, India, China, and Vietnam.

Block them if you can and you'll knock out over 90% of the malicious traffic.

Now don't say you weren't told. [B-o]


Offline
CKA Moderator
CKA Moderator
User avatar
Profile
Posts: 33975
PostPosted: Thu Sep 07, 2017 8:31 am
 


The trouble is that most users send documents as attachments, instead of putting them in Sharepoint and giving a link to them. :(

Otherwise, we'd ban all attachments.


Offline
CKA Moderator
CKA Moderator
 Vancouver Canucks


GROUP_AVATAR
User avatar
Profile
Posts: 63946
PostPosted: Thu Sep 07, 2017 10:52 am
 


I'd rather just find the ransomware criminals and lay on an airstrike for their coordinates.


Offline
CKA Moderator
CKA Moderator
User avatar
Profile
Posts: 33975
PostPosted: Thu Sep 07, 2017 11:02 am
 


BartSimpson wrote:
I'd rather just find the ransomware criminals and lay on an airstrike for their coordinates.


'Whisper in their ear'. ;)

Leaves infrastructure intact, along with witnesses to tell the tale.


Post new topic  Reply to topic  [ 4 posts ] 



Who is online

Users browsing this forum: No registered users and 1 guest




 
     
All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest © Canadaka.net. Powered by © phpBB.