New wave of ransom-style scams hit the Internet

Ransomware scams have been common on the Internet for more than a year, but this particular one features a more recently-evolved sting in the tail.
3/9/2010 6:00:00 AM By: John E. Dunn and Joaquim P. Menezes

Criminals reused an attack from 2008 to hit the Internet with a huge wave of ransomware in recent weeks, a security company has reported.

In the space of only two days, February 8 and 9, the HTML/Goldun.AXT campaign detected by Fortinet accounted for more than half the total malware detected for February, which gives some indication of its unusual scale.

The attack itself takes the form of a spam e-mail with an attachment, report.zip, which if clicked automatically downloads a rogue antivirus product called Security Tool. It is also being distributed using manipulated search engine optimization (SEO) on Google and other providers.

Such scams have been common on the Internet for more than a year, but this particular one features a more recently-evolved sting in the tail.

The product doesn't just ask the infected user to buy a useless license in the mode of scareware, it locks applications and data on the PC, offering access only when a payment has been made through the single functioning application left, Internet Explorer.

What's new, then, is that old-style scareware has turned into a default ransom-oriented approach.

The former assumes that users won't know they are being scammed, while the latter assumes they will but won't know what to do about it.

The technique is slowly becoming more common -- see the Vundo attack of a year ago -- but what is also different is the size of this attack, one of the largest ever seen by Fortinet for a single malware campaign.

Fortinet notes that Security Tool is really a reheat of an old campaign from November 2008, which pushed the notorious rogue antivirus product Total Security as a way of infecting users with a keylogging Trojan.

"This is a great example of how tried and true attack techniques/social engineering can be recycled into future attacks," says Fortinet's analysis.

Page Navigation 1) Attack revived to conduct massive ransomware scams. - Page 1
2) Three-quarters of business have experienced cyber-attack in past year. - Page 2
3) Attacks result in lost revenue, lost productivity and loss of customer trust. - Page 3

Next Page>>

<< Back