Don't Update Your Windows 10 Via Email, It Might Be Cyborg Ransomware

If you're planning to hit the update button via any email update on your Windows 10 powered laptop or PC then it's better to drop the plan right now because that is a fake update which can inject ransomware on your system. According to security researchers from Trustwave's SpriderLabs, a malicious campaign is sending out spoofed emails from Microsoft to inject Cyborh ransomware. Here are more details:

As per security researchers, target users will receive an email which will arrive with some subject like 'Install Latest Microsoft Windows Update now!' or 'Critical Microsoft Windows Update!' Don't trust these emails because Microsoft sends updates via Windows updates and not through emails.

These emails will arrive with one line content like "Please install the latest critical update from Microsoft attached to this email". It will also come with a ".jpg" attachment which is actually an executable file. This file is malicious .NET download which is designed by the attacker to inject malware in your system. Researchers said that this file will inject Cyborg ransomware.

While clicking on the email attachment, the hidden executable will download a file called 'bitcoingenerator.exe'. This file is a .NET compiled malware called Cyborg ransomware.

Do note that once activated, the ransomware will start encrypting all the files on the infected user's computer or laptop. It will also add their filenames with its own record augmentation, 777. After that, the malware will leave a ransom note with the file name 'Cyborg_DECRYPT.txt'. At last, the ransomware leaves a duplicate of itself called 'bot.exe' covered up at the base of the infected drive.

"The Cyborg Ransomware can be created and spread by anyone who gets hold of the builder. It can be spammed using other themes and be attached in different forms to evade email gateways. Attackers can craft this ransomware to use a known ransomware file extension to mislead the infected user from the identity of this ransomware," writes Diana Lopera on Trustwave blog post explaining about the malware.