• This devious ransomware is spreading through fake Tripadvisor com

    From TechnologyDaily@1337:1/100 to All on Mon Aug 14 14:15:03 2023
    This devious ransomware is spreading through fake Tripadvisor complaints

    Date:
    Mon, 14 Aug 2023 14:01:28 +0000

    Description:
    Your restaurant isn't getting suspended from TripAdvisor, it's a ruse to get you to download malware.

    FULL STORY ======================================================================

    Restaurant owners are being targeted by redesigned ransomware in a new campaign that impersonates TripAdvisor, experts have found.

    Cybersecurity researchers from Sophos found a new phishing campaign in which victims are getting emails claiming to come from TripAdvisor and holding complaints from customers. The emails will try to deliver an attachment named TripAdvisorComplaint.zip which, if downloaded, will either hold an executable file called TripAdvisor Complaint - Possible Suspension.exe, or an HTML file of a similar name.

    Its business as usual for hackers distributing malware via emails - the contents are meant to create a sense of urgency and disaster with the victim, so that they dont act rationally and dont think before downloading the files. Paying with Bitcoin

    Those that fall for the trap and run the HTML file will suffer a Browser-in-the-Browser type of attack, and will think their browser opened a window to TripAdvisor, where they can read the complaints submitted to their restaurant. The Read complaint button will download an Excel XLL file called TripAdvisor_Complaint-Possible-Suspension.xll which, in turn, runs the Knight Lite ransomware encryptor.

    The encryptor does the usual - encrypts the file and leaves a ransom note, demanding $5,000 in Bitcoin in exchange for the decryption key. BleepingComputer says that multiple victims got the same Bitcoin address in their ransom note, which only adds further risk to the payment - theres no
    way of proving who made the payment, and someone else can swoop in and claim the payment (and the decryption key) for themselves. Read more

    Ransomware is up significantly this year - is your business a prime target?


    A shocking number of businesses aren't getting their data back after a
    ransomware attack


    Here are the best endpoint protection tools right now

    The good news is that by press time - no one seems to have paid the ransom demand. The Bitcoin address - 14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z - currently has no funds and nothing in the transaction history. The ransomware leak site is also empty, BleepingComputer found.

    The Knight Lite ransomware encryptor is a rework of the Cyclops ransomware-as-a-service, which launched in May 2023 and rebranded a few
    months later. The encryptors are available for Windows, macOS, and Linux. Here's our rundown of the best firewall software

    Via: BleepingComputer



    ======================================================================
    Link to news story: https://www.techradar.com/pro/this-devious-ransomware-is-spreading-through-fak e-tripadvisor-complaints


    --- Mystic BBS v1.12 A47 (Linux/64)
    * Origin: tqwNet Technology News (1337:1/100)