[ March 19, 2019 ]
A new phishing campaign that leverages GandCrab v5.2 ransomware to infect the Chinese government officials has been discovered recently. The malware comes concealed as an archive named ‘03-11-19.rar’.
According to China’s Internet Network Information Center, the phishing attack has started since March 11, 2019. The hackers are targeting the websites of relevant government departments in China with emails containing ransomware. The emails are sent by different senders such as ‘Min, Gap Ryong’. Going by the sender’s name, it is believed that the operators are from North Korea.
What does the ransomware do – Once installed, GandCrab v5.2 encrypts the hard disk data of the user host and redirects the users to download the Tor browser. The Tor browser later logs into the attacker’s digital currency payment window and asks the victim to pay the ransom.
What steps are taken – Following the discovery, all units of the Chinese government have been asked to monitor their systems and report any future attacks.
Cyber Security Tips :
– Keep the antivirus up-to-date;
– Disable automatic functions for USB ports;
– Disconnect infected hosts or servers;
– Upgrade the operating systems to latest versions.