Cisco 's Talos Security Intelligence and Research Group has detected a ransomware campaign targeting Windows 10 , just two days after the official release of Microsoft's new operating system.
As with most Ransomware campaigns, attackers resort to various tricks and often exploit current events in order to force users to download malicious files to their computers.
Within two days, Windows 10 has already been installed on more than 67 million computers, while the total installations are expected to skyrocket in the near future according to the company's estimates. This fact makes Windows 10 a dominant subject for Ransomware campaigns, with Cisco's Talos team having already identified one of them:
Using an IP address assigned to Thailand, the attackers are distributing specially crafted emails to unsuspecting users, urging them to install Microsoft's new operating system.
These messages contain an attached ZIP file, which includes an executable file that leads to the installation of the known Ransomware, CTB-Locker.
If users' antivirus does not detect the malware, they are locked out of their computers and the following message appears:
According to the Cisco team, “the Ransomware uses asymmetric encryption that allows attackers to encrypt the user’s files, without requiring the decryption key to exist on the infected system.”
Users have only four days to pay the requested ransom to decrypt their files, a much shorter timeframe compared to other modern ransomware campaigns.
Additionally, through the use of the Tor anonymity network, as well as the use of digital currencies to pay the ransom, attackers are able to maintain their anonymity and quickly profit from ransomware campaigns with minimal risk.”
The Cisco team recommends that users create backups of their computers on a regular basis, which they should store offline.
