5 ms·
Exactly my first reaction. At the moment we get hundreds of Locky mails per day. There is a huge spike in ransomware at the moment. And all ransom has to be p
by huuu 11y ago
Exactly my first reaction.
At the moment we get hundreds of Locky mails per day.
There is a huge spike in ransomware at the moment. And all ransom has to be paid via a tor location.
- arprocter 11y agoWe started blocking .docm at the mail server (it uses a Word macro to download)
- SCHiM 11y agoThat won't block all macro viruses. You need a dedicated program/firewall for this, filtering on extension won't work. Older .doc formats can also have macro's included and will work in newer (as well as older) versions of word.
- arprocter 11y agoThis was just to prevent this specific attack - kind of a stopgap until the AV detects it properly. IIRC last time I checked the Word doc on virustotal it was picked up 22/55. Fortunately at least AV did pick up the payload when a user let the macro run... Edit, ran it by virustotal again and got 28/55