Cyberpolice warn of new encryption virus spread

The malware was first discovered by cybersecurity specialists in June 2017. On November 24, police recorded its spread through the major spam botnet, "Necurs".

Cybersecurity experts revealed that more than 12.5 million e-mails containing files with the new version of Scarab ransomware were sent via Necurs.

E-mail correspondence containing Scarab were disguised as archives with scanned images.

Those who received such emails saw that they allegedly included attached files with images of scanned documents. For example: "Scanned from Lexmark", "Scanned from HP", "Scanned from Canon", "Scanned from Epson".

Read alsoUK spymasters raise suspicions over Kaspersky’s Russia links - FTThese letters contained a 7Zip archive with the archived Visual Basic script. After it is triggered, the EXE file, which is the Scarab ransomware virus, is downloaded and launched to the user's computer.

After successful encryption, the virus creates and automatically opens a text file with a ransom demand, and then places it on the desktop.

The amount of ransom is not indicated. However, attackers inform the victim that this amount will increase over time, until the victim contacts the Scarab authors by e-mail or BitMessage.

Over the past day, the Cyber Police Department of the National Police of Ukraine received no appeals and reports regarding the virus.

To reduce the risks of being affected by the new ransomware, cyberpolice experts recommend that users carefully treat all electronic correspondence and not open such applications even if they come from a reliable source.Read also1+1 media reported to Cyberpolice on Newzmate startup over illegal mining on group’s websites

Also, the police advise the users to receive confirmation of file transfers via other available communication channels (telephone, sms, or messengers).