GoldenEye ransomware disguised as job application

Opening the Excel attachment will encrypt the files on your computer

Check Point has uncovered a ransomware attack that is targeting German HR managers by posing as a legitimate job application.

The email is sent with a harmless PDF covering letter and an Excel spreadsheet that contains the ransomware. When the victim opens the Excel spreadsheet, they are invited to enable content so the macros can run. Upon giving the go-ahead, the malicious macro will launch a program that encrypts all the files on the user's computer, presents the message "YOUR_FILES_ARE_ENCRYPTED.TXT".

While the files are being encrypted, the user is faced with a fake "chkdsk" screen, urging them not to turn off their PC. When all the files are encrypted, they will see a skull and crossbones and be told their files have been encrypted using GoldenEye, with instructions of how to pay the ransom and unlock their files. The rates to unlock files start at 1.3 Bitcoins (800) per infection.

"Despite trying to brand itself as a new malware, GoldenEye, the latest Petya variant, is very similar to older versions and differs mostly in its "golden" motif," Check Point explained. "The most prominent change, however, is how the campaign spreads the ransomware.

Advertisement
Advertisement - Article continues below

"The current campaign used to distribute GoldenEye has a job application theme. It is therefore aimed at companies' Human Resources departments, due to the fact they usually cannot avoid opening emails and attachments from strangers, a common malware infection method."

The researchers said the campaign has only been running for a few days and it seems as though the infected attachment has been given a number of names, making it even more confusing for recipients. However, they follow the same format, with the supposed candidate's name as the first part of the file name and "Bewerbung", meaning "application" in German, as the second part.

Main image credit: Check Point

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/29204/how-can-you-protect-your-business-from-crypto-ransomware
Security

How can you protect your business from crypto-ransomware?

4 Nov 2019
Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/ransomware/28070/best-ransomware-removal-tools
Security

Best ransomware removal tools

7 Dec 2018
Visit/antivirus/28144/best-antivirus
antivirus

Best antivirus for Windows 10

3 Sep 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/business/policy-legislation/354282/boris-johnson-suggests-uk-will-side-with-us-over-huawei
Policy & legislation

Boris Johnson suggests UK will side with US over Huawei exclusion

5 Dec 2019