Security Market Segment LS
Wednesday, 20 November 2019 11:16

Cyborg ransomware being spread through fake Windows update emails

By
Cyborg ransomware being spread through fake Windows update emails Image by Tumisu from Pixabay

Malicious attackers are using fake emails about Windows updates to trick users into downloading the Cyborg ransomware, the security firm Trustwave claims.

In a blog post, Trustwave's Diana Lopera said the subject lines on the emails were either " Install Latest Microsoft Windows Update now!" or "Critical Microsoft Windows Update!"

The email had an attachment with a .jpg extension which was actually a Windows executable. This then downloaded a second executable file hosted on the Microsoft-owned GitHub.

"The file bitcoingenerator.exe will be downloaded from misterbtc2020, a Github account which was active for a few days during our investigation, but is now removed," Lopera said.

"It is contained under its btcgenerator repository. Just like the attachment, this is .NET compiled malware, the Cyborg ransomware."

The ransomware would then encrypt the user’s files and append to their filename its own file extension - 777.

The ransom note, as usual placed on the user's desktop, asked for US$500 in bitcoin to be sent to a certain wallet.

Having found that the file extensions generated by these Cyborg samples differed, Trustwave researchers searched for the builder used to generate the malware. They found a YouTube video that linked to the builder that was hosted on GitHub.

"The GitHub account Cyborg-Ransomware was newly created too. It contains two repositories: Cyborg-Builder-Ransomware, and Cyborg-Russian-version," Lopera wrote.

"The first repository has the ransomware builder binaries while the second one contains a link to the Russian version of the builder hosted at another website."

BUSINESS WORKS BETTER WITH WINDOWS 1O. MAKE THE SHIFT

You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer

Timezones

QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.

REGISTER!

ADVERTISE ON ITWIRE NEWS SITE & NEWSLETTER

iTWire can help you promote your company, services, and products.

Get more LEADS & MORE SALES

Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]

OR CLICK HERE!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

VENDOR NEWS & EVENTS

REVIEWS

Recent Comments