We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,764 News Articles

Net hit by Ransomware attack first seen in 2008

Attack made up more than half of malware in Feb

Cybercriminals have once again hit the web with a ransomware campaign that was first used in 2008, says Fortinet.

According to the security firm, in the space of only two days, 8 and 9 February, the HTML/Goldun.AXT campaign accounted for more than half the total malware detected for February, which gives some indication of its unusual scale.

The attack itself takes the form of a spam email with an attachment, report.zip, which if clicked automatically downloads a rogue anti-virus product called Security Tool.

It is also being distributed using manipulated search engine optimisation (SEO) on Google and other providers.

Such scams have been common on the internet for more than a year, but this particular one features a more recently-evolved sting in the tail.

The product doesn't just ask the infected user to buy a useless licence in the mode of scareware, it locks applications and data on the PC, offering access only when a payment has been made through the single functioning application left, Internet Explorer.

What's new, then, is that old-style scareware has turned into a default ransom-oriented approach. The former assumes that users won't know they are being scammed, while the latter assumes they will but won't know what to do about it.

The technique is slowly becoming more common - see the Vundo attack of a year ago - but what is also different is the size of this attack, one of the largest ever seen by Fortinet for a single malware campaign.

Fortinet notes that Security Tool is really a reheat of an old campaign from November 2008, which pushed the notorious rogue antivirus product Total Security as a way of infecting users with a keylogging Trojan.

"This is a great example of how tried and true attack techniques/social engineering can be recycled into future attacks," says Fortinet's analysis.

According to Fortinet, the 'engine' pushing the spike in ransom-based malware is believed to be the highly-resilient Cutwail/Pushdo botnet, the same spam and DDoS system behind a number of campaigns in the last three years including the recent pestering of PayPal and Twitter sites.

See also:  Virus holds data hostage and demands ransom


IDG UK Sites

LG G Watch review: Android Wear smartwatch is the best around, so far

IDG UK Sites

How to join Apple's OS X Beta Seed Program: Get OS X Yosemite on your Mac before public release

IDG UK Sites

Why the BBC iPlayer outage was caused by a DDoS attack: Topsy and Tim isn't *that* popular

IDG UK Sites

BBC using Glasgow 2014 Commonwealth Games to trial 4K/UHD, pan-around video, augmented video and...