![\"\"](\"https:\/\/sitesdev.net\/articles\/wp-content\/uploads\/2017\/05\/Watch.jpg\")
Hackers have once again pushed the envelope. They\u2019ve again come up with a new way to infect target computers and get around whatever detection software is in place. The latest twist is sending encrypted Word files to your employees.<\/p>\nHackers have once again pushed the envelope. They\u2019ve again come up with a new way to infect target computers and get around whatever detection software is in place. The latest twist is sending encrypted Word files to your employees.<\/p>\n
These files are accompanied by an email, describing the attachment as an invoice for some service your company has supposedly paid for. The instructions in the email helpfully include a password that can be used to open the file.<\/p>\n
If a user double clicks the attachment, sure enough, they\u2019re presented with a password prompt. Typing in the password brings up a word document that contains several other embedded docs.<\/p>\n
If the user clicks on any of the embedded documents, they\u2019ll be prompted to run a VBScript, and if they click \u201cyes\u201d to do so instead of opening the expected Word file, what actually happens is that the keylogger Ursnif is installed.<\/p>\n
This keylogger not only logs all of the user\u2019s keystrokes from that point on and stores them in an archive file, but also includes notes on any applications that are opened and copies of any files that are created. In addition, it makes copies of anything placed on the user\u2019s clipboard.<\/p>\n
The archive files created by the malware are then periodically shipped, via TOR, to the hackers for review.<\/p>\n
It\u2019s an amazingly effective solution, and it works because when a Word file is password protected, it becomes encrypted, which makes it harder for most antivirus software to detect any malware it might contain. It also relies heavily on social engineering, because after all, you\u2019ve got diligent employees who want to do a good job, and will want to promptly pay their invoices. This is the key that gets a surprising percentage of them to open the poisoned files in the first place.<\/p>\n
As ever, education is the order of the day here, and by far the best method of minimizing the impact of such an attack on your organization. Now would be a good time to remind all employees never to open attachments sent to them via unknown parties, and even if the sender is known, a great second step is to pick up the phone and call for verification.
\nSuch steps can save you a lot of grief, and a lot of money.<\/p>\n","protected":false},"excerpt":{"rendered":"
Hackers have once again pushed the envelope. They\u2019ve again come up with a new way to infect target computers and get around whatever detection software is in place. The latest twist is sending encrypted Word files to your employees. These files are accompanied by an email, describing the attachment as an invoice for some service […]<\/p>\n","protected":false},"author":5,"featured_media":25304,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[34,30],"yoast_head":"\n