As we know, end of support for Windows 7 is coming in January. Lots of users still need to update to Windows 10 so that they continue getting security updates and support from Microsoft. Attackers are targeting Microsoft users with fake Windows update emails that will infect computers with ransomware. Ransomware locks up valuable data on your computer, and demands that you pay a ransom to release it or your data will be destroyed.
The spammers send Windows users emails with subject lines such as “Install Latest Microsoft Windows Update now!” or “Critical Microsoft Windows Update!” In this case, the emails, which claim to be from Microsoft, include one sentence in the message body, which starts with two capital letters. They ask recipients to click an attachment to download the “latest critical update.”
The attachment has a .jpg file extension, but is actually a malicious .NET downloader, which will deliver malware to your machine. The ransomware, called bitcoingenerator.exe, will encrypt the recipient’s files, and leaves a ransom note titled “Cyborg_DECRYPT.txt” on their desktop, asking for $500 in bitcoin to unlock the files.
The ransomware came from a Github account, which was active but has since been removed. Unfortunately, this form of ransomware can be created relatively easily, and spread by anyone who gets hold of the builder. This can be attached to different types of emails to get through spam filters.
Most ransomware attacks come in through email, so users should be wary of opening any email attachment or link from an unknown sender. This applies even if it seems to be from a reputable company. Microsoft is impersonated more than any brand when sending security emails. Bad spelling or poor formatting are often clues of an attack.
Don’t forget – Microsoft will never send patches via email, but will use their internal update utility embedded in Windows. Also always be wary of any unsolicited emails, especially those that state that your urgent action is required by clicking a link or opening an attachment.
If you are ever in doubt, feel free to just phone us – better to be safe than sorry!
