Ransomware targeting U.S. encrypts files using Windows PowerShell

Adam GreenbergJune 4, 2014

A new variant of ransomware using Windows PowerShell to encrypt files is targeting users in the United States, according to a Sunday post by Mark Manahan, threat response engineer with Trend Micro.

Those infected by TROJ_POSHCODER.A will receive a message that states their files were encrypted and locked with a RSA4096 key, according to the post. Victims are then instructed to download the Tor browser and go to a specific website.

The website on the Tor network instructs victims to download the MultiBit Bitcoin wallet, to purchase one Bitcoin, and to submit a form after the Bitcoin is sent to a specific address, according to the post. The attackers claim they will email the “decryptor" within 12 hours of receiving the Bitcoin.

Recovery is only guaranteed for ten days, according to the post.

Adam Greenberg

Abstract Red Background with Binary Code Numbers. Data Breach, Malware, Cyber Attack, Hacking

Critical Infrastructure Security

Russian infrastructure disrupted by Ukrainian hackers

SC StaffApril 16, 2024

Operations of Russia's industrial sensor and monitoring infrastructure were claimed to have been disrupted by Ukrainian hacking operation Blackjack following a Fuxnet malware attack against Moscow-based underground infrastructure firm Moscollector, reports SecurityWeek.

Warning icon on a digital LCD display with reflection.

Vulnerability Management

Steganography leveraged in new global TA558 attack campaign

SC StaffApril 16, 2024

More than 320 organizations in various sectors around the world, most of which are in Latin America, have been subjected to the new SteganoAmor attack campaign by the TA558 hacking operation that involved the use of steganography to enable the delivery of various malicious payloads, according to BleepingComputer.

Vulnerability Management

Availability of CISA’s automated malware analysis service expanded

SC StaffApril 11, 2024

The Cybersecurity and Infrastructure Security Agency has expanded access to its Malware Next-Gen malware analysis service to organizations in the private sector months after it was offered to government and military workers, reports The Record, a news site by cybersecurity firm Recorded Future.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news