Mozilla issued a warning this week about malicious websites offering Thunderbird downloads, after identifying a ransomware that was using this technique to deliver malware.
See also: Mozilla: Fixes zero-day affecting Firefox and Thunderbird
Cybersecurity journalist Brian Krebs reported last week that a website on which the Snatch ransomware group exposes its victims has begun leaking data, including visitor IPs and information about internal operations.
According to Krebs, the leaked data suggests that the Snatch hacking group is using paid Google ads to distribute malware that hides behind popular applications such as Adobe Reader, Discord, Microsoft Teams , and Mozilla Thunderbird.
Following Krebs' findings, Mozilla issued a "ransomware alert" this week, advising users to only download Thunderbird from trusted websites.
See also: Tesla: First on Mozilla's list of the most "creepy" industries
Mozilla notes that it actively tries to remove malicious websites that offer Thunderbird, but these are hosted in Russia, which makes their removal “difficult and often ineffective.”
Thunderbird has less than one percent market share in the email client category, but that still represents a significant number of individuals and organizations that could be targeted by Snatch ransomware.
To combat fake Thunderbird downloads, Mozilla provides a safe and trusted source for downloading the program. The best way to avoid malware is to download Thunderbird only from the official Mozilla website. This will ensure that you have the latest and most secure version of the program. In addition, Mozilla provides security tools to verify the authenticity of Thunderbird downloads. You can check the digitally signed installation file to make sure that it comes from Mozilla and has not been modified by malicious users.
See also: Mozilla Firefox: End of support for some macOS versions
The US government recently issued an alert, warning critical infrastructure organizations of ongoing Snatch ransomware attacks.
