skip to Main Content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail info@tidorg.com with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038 info@tidorg.com

    ‘Fake Ransomware’ as a Form of Social Engineering

    Fake Ransomware Form of Social Engineering

    Attackers are exploiting a vulnerability in a WordPress plugin to deface several hundred websites with phony warnings of ransomware, the Record reports. Researchers at Sucuri found that around three hundred WordPress sites displayed the text “SITE ENCRYPTED” followed by “FOR RESTORE SEND 0.1 BITCOIN.” (A Google search for this text shows that many sites are still affected.)

    The researchers note that 0.1 Bitcoin is currently worth about $6,000, which is low enough that a small business might consider paying it if they thought their website had been encrypted. The Record says that no one has paid the ransom yet, which is probably due to the fact that the ransom note only appears on a few pages on the website. The attackers used a vulnerability in the legitimate business directory listing plugin Directorist.

    “In checking the access logs for the website it was easy enough to determine the IP address responsible,” Sucuri says. Our client was located in the southern United States, however we saw quite a few requests from a foreign IP address which was interacting with the directorist plugin using the plugin editor feature of wp-admin. This suggests that the legitimate plugin was already installed on the website and later tampered with by the attackers.”

    In the case that Sucuri examined, the researchers note that the attacker had access to the site’s administrative password.

    “Interestingly, the very first request that we saw from the attacker IP address was from the wp-admin panel, suggesting that they had already established administrator access to the website before they began their shenanigans,” the researchers write. “Whether they had brute forced the admin password using another IP address or had acquired the already-compromised login from the black market is anybody’s guess.”

    New-school security awareness training can enable your employees to remain level-headed when they encounter social engineering attacks.

    Sucuri has the story.


    Free Ransomware Simulator Tool

    Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

    KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

    RansIm-Monitor3

    Here’s how it works:

    • 100% harmless simulation of real ransomware and cryptomining infections
    • Does not use any of your own files
    • Tests 21 types of infection scenarios
    • Just download the install and run it 
    • Results in a few minutes!

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW

    close

    Sign Up to the TIO Intel Alerts!

    Back To Top