Ransomware Distributed by Fake Tripadvisor Reviews

The Knight ransomware-as-a-service offering (formerly known as “Cyclops”) is using phony TripAdvisor complaints to deliver its malware, BleepingComputer reports.

“A newer version of this campaign spotted and analyzed by BleepingComputer now includes an HTML attachment named 'TripAdvisor-Complaint-[random].PDF.htm,’” BleepingComputer says. “When the HTML file is opened, it will use Mr.D0x's Browser-in-the-Browser phishing technique to open what appears to be a browser window to TripAdvisor.

This fake browser window pretends to be a complaint submitted to a restaurant, asking the user to review it. However, clicking the 'Read Complaint' button will download an Excel XLL file named ‘TripAdvisor_Complaint-Possible-Suspension.xll.’” The Excel file attempts to trick the user into enabling an add-in, which will trigger the ransomware.

“When you open the XLL, Microsoft Excel will detect the Mark of the Web (MoTW), added to files downloaded from the Internet, including email,” BleepingComputer says. “If it detects the MoTW, it will not enable the .NET add-in built into the Excel document, nullifying the attack unless a user unblocks the file.

However, if there is no MoTW flag on the file, Excel will prompt the user as to whether they want to enable the add-in....Enabling the add-in will cause the Knight Lite ransomware encryptor to be injected into a new explorer.exe process and begin to encrypt the files on your computer.”

BleepingComputer notes that in the ransomware’s current iteration, the threat actors won’t be able to tell which victims have paid the ransom, so it’s doubtful that they have any intention of sending decryption keys.

“The ransomware will create a ransom note named ‘How To Restore Your Files.txt’ in each folder on the computer,” BleepingComputer says. “The ransom note in this campaign demands $5,000 be sent to a listed Bitcoin address and also contains a link to the Knight Tor site. However, every ransom note in this campaign seen by BleepingComputer utilizes the same Bitcoin address of '14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z,' which would make it impossible for the threat actor to determine which victim paid a ransom.”

New-school security awareness training can help prevent ransomware from getting onto your systems in the first place by teaching your employees to recognize phishing attacks.