That new Windows 10 update could be packed with ransomware

Users have been warned not to download a fake Windows 10 update which is actually packed with malware. Security researchers from Trustwave&...

Users have been warned not to download a fake Windows 10 update which is actually packed with malware.

Security researchers from Trustwave's SpiderLabs have uncovered a new malicious campaign that spoofs an urgent update email from Microsoft to infect user's systems with the Cyborg ransomware.

Targeted users first receive an email with either the subject line 'Install Latest Microsoft Windows Update now!' or 'Critical Microsoft Windows Update!' which is already suspicious as Microsoft pushes Windows updates through its operating system and never through emails.

The email itself contains just one line of text which reads: “Please install the latest critical update from Microsoft attached to this email”. While the fake update attachment has “.jpg” file extension, it is actually not a picture but instead is an executable file.

This executable file is a malicious .NET download that the attackers have designed to deliver malware to the infected system.

Cyborg ransomware

Upon clicking on the email's attachment, the executable hidden within it downloads a file called 'bitcoingenerator.exe' from a GitHub account with the name misterbtc2020. Just like with the attachment itself, this file is a .NET compiled malware known as the Cyborg ransomware.

Once activated, the ransomware encrypts all of the files on the infected user's system and appends their filenames with its own file extension, 777. A ransom note with the filename 'Cyborg_DECRYPT.txt' is then left on the desktop of the compromised machine. Finally the ransomware leaves a copy of itself called 'bot.exe' hidden at the root of the infected drive.

In an effort to better understand the variants of the Cyborg ransomware, Trustwave researchers searched for the original filename of the ransomware they obtained and searched for it in VirusTotal. There they found three other samples of this ransomware and discovered that a builder for it exists online.

The researchers also found a GitHub account with the name Cyborg-Ransomware that contained a repository with the ransomware builder binaries as well as a second repository with a link to the Russian version of the same builder hosted on another site.

Trustwave's Diana Lopera explained why the Cyborg ransomware poses a serious threat to individuals and businesses in a blog post, saying:

“The Cyborg Ransomware can be created and spread by anyone who gets hold of the builder. It can be spammed using other themes and be attached in different forms to evade email gateways. Attackers can craft this ransomware to use a known ransomware file extension to mislead the infected user from the identity of this ransomware.”

  • Protect your devices from the latest cyber threats with the best antivirus software


from TechRadar - All the latest technology news https://ift.tt/2s1FpmL
via IFTTT

COMMENTS

BLOGGER
Name

Apps,3858,Business,151,Camera,1155,Earn $$$,3,Gadgets,1741,Games,926,GTA,1,Innovations,3,Mobile,1697,Paid Promotions,5,Promotions,5,Sports,1,Technology,8106,Trailers,796,Travel,37,Trending,4,Trendly News,25335,TrendlyNews,110,Video,5,XIAOMI,13,YouTube - 9to5Google,109,
ltr
item
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: That new Windows 10 update could be packed with ransomware
That new Windows 10 update could be packed with ransomware
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
http://www.trendlynews.in/2019/11/that-new-windows-10-update-could-be.html
http://www.trendlynews.in/
http://www.trendlynews.in/
http://www.trendlynews.in/2019/11/that-new-windows-10-update-could-be.html
true
3372890392287038985
UTF-8
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy