ESET LiveGrid telemetry shows a spike in detection of the JS / Danger.ScriptAttachment (Locky) malware in several European countries . The most notable detection rates are in Luxembourg (67%), Czech Republic (60%), Austria (57%), Netherlands (54%) and United Kingdom (51%), as well as in other European countries . Detection rates are also particularly high in Greece and Cyprus , where they reach 43%.
It appears as an email attachment and once opened , the threat behind these detections is designed to download and install different malware variants on victims' devices
Once it manages to trick theuser, JS /Danger.ScriptAttachment tries to downloadanother malicious code, consisting primarily of various crypto-ransomware families, such as Locky.
An extensive description of how Locky works can be found inthe special analysis on WeLiveSecurity.com.
"Users of ESET solutions are protected from this threat. Our solutions can block malicious intents to download and execute various ransomware families," comments Ondrej Kubovič, IT Security Specialist at ESET.
JS /Danger.ScriptAttachment has the same purpose as the Nemucod malicious downloader that hit the internet globally in waves. ESET warned users about the threat in late December 2015 , and again in March 2016.
ESET considers this ransomware to be one of the most dangerous computer threats at the moment , and this is unlikely to change in the near future . Therefore, ESET recommends that internet users , whether at home or in the workplace, keep their computers and software up to date , use reliable security software , and regularly back up their valuable data .
Prevalence of the JS/Danger.Script.Attachment downloader in Europe
Detection rates range from 67 % ( Luxembourg ) to below 1% (Belarus, Ukraine).
Prevalence levels:
Luxembourg: 67%
Austria: 57%
Netherlands: 54%
United Kingdom: 51%
Germany: 48%
Denmark: 48%
Ireland 46%
Sweden: 46%
Belgium: 45%
Greece 43%
Spain: 42%
Finland: 42%
Norway: 40%
France: 36%
Portugal: 30%
Poland: 26%
