New “Ransomware Update” Phishing Attack Seeks to Enjoy the Same Successes as the Recent Pipeline Attack

"New Ransomware Update" Phishing AttackWhen your users receive a realistic-looking helpdesk email informing them they should update their system to prevent ransomware attacks, what could possibly go wrong?

As we continue to hear about major companies such as Fuji Film and the world’s largest meat supplier being taken down with ransomware, the bad guys are leveraging the notoriety of these kinds of attacks as a means to create the needed urgency on the part of the phishing victim.

In a new attack spotted by anti-phishing vendor, Inky, victims are sent an email impersonating their own internal helpdesk – in some cases, complete with company branding – warning them to update their system to protect against ransomware:










Source: Inky

Using plausible domains like selectivepatch [dot] com, the bad guys take victims to a professional-looking ransomware update page with a download named – what else? – Ransomware_Update.exe. This attack even evades detection as a malicious URL due to their use of legitimate free websites. Of course, there’s no update; the bad guys are actually downloading Cobalt Strike, a legitimate pen testing tool misused by cybercriminals due to its source code being leaked last year.

Users who fall for this attack are, no doubt, simply wanting to do the right thing. And it’s this inability to distinguish helpful from harmful that demands users be enrolled in continual Security Awareness Training so they can better understand how to identify suspicious or malicious emails immediately upon receiving them.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 21 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing, Ransomware

Subscribe To Our Blog

Cybersecurity Awareness Month Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews