Copyright Claim Email is a LockBit Ransomware Phishing Attack in Disguise
The latest iteration in Copyright Claim scams is an evolution of this repeated attack method that has proven to get the attention – and response – of victims over the last few years.
The scam itself is nothing new; I’ve covered it here when it was targeting Instagram credentials, and before that attempting to install the IceID information-stealing trojan. But according to security researchers at South Korean security vendor AhnLab, it’s LockBit ransomware’s turn.
The attack begins with (according to AhnLabs) a very similarly-written email about the recipient being in violation of a copyright held by the sender, informing the recipient to look at the attachment for more details on the violation.
Source: Ahn Labs
The attack does make several attempts to obfuscate its’ malicious nature from security solutions by attaching a zip file that contains another compressed file – an executable disguised as a PDF document – that is actually an NSIS script file (Nullsoft Scriptable Install System) which is an open-source Windows installer.
There was no detail included around the industry, size, or geography of the campaign’s targets, but according to Palo Alto’s Unit42, LockBit 2.0 historically targets professional services, construction, wholesale and retail, and manufacturing companies.
And while AhnLab’s examples are in Korean, Unit42 notes that LockBit 2.0 has primarily targets the United States, Italy, Germany, Canada, France, the U.K., Spain, Thailand, Brazil and Switzerland.
Users within your organization – particularly those either in Marketing or Legal (who would actually care about a copyright claim) should be put through Security Awareness Training so they are aware of such scams, reducing the likelihood of the attack succeeding.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW