Email Campaign Uses CDC Flu Pandemic Warning to Fool Users into Installing GandCrab Ransomware

Cybercriminals are constantly coming up with new scams to convince people to part with their login credentials or install botnets, viruses, malware, or ransomware.

Email is one of the easiest ways to get these scams out to the masses, accompanied with a good hook to get the user to open the message. Various tactics are used to achieve the latter, one of the most common being fear. Scaring people into taking action is very effective. A recently identified campaign is a good example. It uses fear of a flu pandemic to get users to take action.

According to the U.S. Centers for Disease Control and Prevention, flu killed about 80,000 in the 2017 to 2018 season, which was a record year for flu deaths. The previous record in the past three decades was beaten by 24,000.

For any phishing email to stand a good chance of fooling large numbers of people, the emails must be credible. This campaign provides that credibility by spoofing the CDC. The subject lines used in the campaign warn of a flu pandemic, and the email addresses used and the logos in the message body make the messages appear to have genuinely been sent by the CDC.

The message included an attachment – named Flu Pandemic Warning – provides important information that users need to know to prevent infection and stop the disease from spreading. The fear of contracting flu combined with the realistic looking emails make it likely that this campaign will fool many individuals.

That document contains malicious code that downloads and runs GandCrab ransomware v5.2, for which there is currently no free decryptor. Once downloaded, GandCrab ransomware will encrypt files on the infected computer preventing them from being accessed. The average ransom demand is $800 per infected computer.

In order for the malicious code to download the ransomware, the content must be enabled. In the message body, recipients are told that in order to view all the information in the document they must enable content. This prior instruction is intended to get the user to click ‘enable content’ quickly when the document is opened, rather than to stop and think.

All users should be alert to these kind of email scams. Caution should be exercised before opening any email attachment, no matter how urgent the message appears to be. Any unsolicited email should be carefully checked as there will usually be signs that indicates all is not what it seems.

Businesses are particularly at risk and can suffer major losses as a result of ransomware attacks, especially when several employees are fooled by these email scams.

Signature-based email defenses were once effective at blocking malware, but malware developers are constantly releasing new versions that have never before been seen. Signature-based AV software struggles to maintain pace and is not effective against zero-day malware variants and malicious code that downloads the malware.

End user training certainly goes a long way and can help to prevent mass infections, but what is really needed is an advanced anti-phishing solution that blocks phishing emails and email scams at source before they are delivered to inboxes. That is an area where TitanHQ can help.

To protect against email-based attacks, TitanHQ developed SpamTitan – A highly effective anti-phishing and anti-spam solution with advanced features that provide superior protection against phishing and malware attacks.

In addition to dual anti-virus engines, SpamTitan incorporates a wide range of checks to distinguish malicious emails from genuine messages. Recently, Spamtitan has had two new features incorporated: DMARC email authentication and sandboxing. DMARC helps to ensure that spoofed email messages, such as those that appear to have been sent by the CDC, are identified as scams and are blocked. Sandboxing is important for protecting against zero-day malware threats and malicious downloaders.

Potentially malicious attachments are executed and analyzed in a Bitdefender-powered sandbox, where the actions performed by malware and malicious code can be assessed without causing harm. When malicious code is detected it is blocked across all users’ inboxes.

With SpamTitan in place, businesses will be well protected against campaigns such as this. For further information on TitanHQ’s award-winning anti-spam solution, for a product demonstration, or to register for a free trial, contact the TitanHQ team today and take the first step toward making your email channel much more secure.