IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

GoldenEye ransomware disguised as job application

Opening the Excel attachment will encrypt the files on your computer

Check Point has uncovered a ransomware attack that is targeting German HR managers by posing as a legitimate job application.

The email is sent with a harmless PDF covering letter and an Excel spreadsheet that contains the ransomware. When the victim opens the Excel spreadsheet, they are invited to enable content so the macros can run. Upon giving the go-ahead, the malicious macro will launch a program that encrypts all the files on the user's computer, presents the message "YOUR_FILES_ARE_ENCRYPTED.TXT".

While the files are being encrypted, the user is faced with a fake "chkdsk" screen, urging them not to turn off their PC. When all the files are encrypted, they will see a skull and crossbones and be told their files have been encrypted using GoldenEye, with instructions of how to pay the ransom and unlock their files. The rates to unlock files start at 1.3 Bitcoins (800) per infection.

"Despite trying to brand itself as a new malware, GoldenEye, the latest Petya variant, is very similar to older versions and differs mostly in its "golden" motif," Check Point explained. "The most prominent change, however, is how the campaign spreads the ransomware.

"The current campaign used to distribute GoldenEye has a job application theme. It is therefore aimed at companies' Human Resources departments, due to the fact they usually cannot avoid opening emails and attachments from strangers, a common malware infection method."

The researchers said the campaign has only been running for a few days and it seems as though the infected attachment has been given a number of names, making it even more confusing for recipients. However, they follow the same format, with the supposed candidate's name as the first part of the file name and "Bewerbung", meaning "application" in German, as the second part.

Main image credit: Check Point

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Microsoft to double salary budget to retain workers
Careers & training

Microsoft to double salary budget to retain workers

17 May 2022