A phishing campaign could be distributing ransomware through Facebook Messenger and LinkedIn, according to security firm Check Point, but Facebook has denied this is the case.
Affected users receive a jpeg image file through Facebook Messenger, which appear as a file preview, not an attachment. If they click on the image, they are asked to select a directory in which to download the file. The scam, dubbed ImageGate, embeds the malware into the file, the research firm said.
CheckPoint claimed that double clicking on the saved file releases Locky ransomware, which encrypts files on users' devices, and only grants access after they pay a ransom, though Facebook said the files only lead to bad Chrome extensions.
In a post about these attacks, Check Point researchers Roman Ziakin and Dikla Barda wrote: "In the past week, the entire security industry is closely following the massive spread of the Locky ransomware via social media, particularly in its Facebook-based campaign."
The post adds: "As more people spend time on social networking sites, hackers have turned their focus to find a way into these platforms. Cyber criminals understand these sites are usually 'white listed', and for this reason, they are continually searching for new techniques to use social media as hosts for their malicious activities."
With Locky, there is no way of decrypting files without paying the ransom. Its creators also recently switched to a different encryption extension (.zzzzz), that prompts a different downloader and is harder for an antivirus to detect.
However, IT Pro understands the impact of ImageGate on Messenger users is very limited, and Facebook said it is already blocking the extensions it says these files lead to.
A Facebook spokesperson said: "We maintain a number of automated systems to help stop harmful links and files from appearing on Facebook, and we are already blocking these ones from our platform. In our investigation, we determined that these were not in fact installing Locky malware - rather, they were associated with Chrome extensions. We have reported the bad browser extensions to the appropriate parties."
Picture credit: Facebook
-
The channel is heading straight for an AI infrastructure wallIndustry Insights AI ambition is accelerating faster than channel infrastructures, however data architecture and enterprise readiness can support
-
Logitech’s new keyboard and mouse aim to make you as comfortable as possible while you work from home (or in the office)News The Signature Comfort Plus keyboard and mouse are soft and padded, and full of customisable buttons
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacks
News Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
