The notorious Necurs botnet has upped its crime game by adopting a retro trick to make itself more evasive and less likely to having its phishing intercepted by your filters. Stu Sjouwerman, Founder and CEO, KnowBe4, Inc. explained that Necurs is one of the oldest and largest spam and phishing delivery systems in existence. It controls millions of machines that the criminal botmasters use to send malicious payloads. He provides an update here.
What’s happening now
Necurs has begun emailing archive files that unzip to a file with a .URL extension. This commonplace Windows shortcut opens a page directly in a browser. The advantage of this approach is that it’s typically overlooked by email filters which are hunting for more complicated infection chains. The final destination of this link is a remote script file that downloads and automatically executes a malicious payload.
This common Windows shortcut is the social engineering tactic which tricks your users into thinking the email file attachment they just unzipped has created a folder that they need to enter and view the actual file.
Unfortunately, this is what crooks want because trying to access this faux folder will launch the infection chain. This time, they are exploiting the power of simplicity.
Update your filter settings
Your email filters usually apply preset rules, and this particular vector is probably not among them, so update your filter settings. Interestingly, Necurs does not infect computers using Russian as a language.
Tell everyone
Email the following message to your employees, friends and family:
There is a new email scam you need to watch out for. Bad guys are sending emails that have an archive file as an attachment. They often look like a voice mail message you have missed. Assume these attachments files are guilty until proven innocent!
Do not click on the zip file to listen to the message. Delete the file or click on the Phish Alert Button which forwards it to IT and deletes it from your inbox.
Some background
Necurs emerged in 2012 as an infector and rootkit, and quickly partnered with elite cybercrime gangs to become part of the top spamming and infection forces in the malware realm. According to McAfee Labs Threats Report, March 2018, Necurs is currently the world’s largest spam botnet.
Security Intelligence reports that unlike most botnets, Necurs stands out due to its technical complexity, partnership diversity and continued evolution in an era when even the most complex malicious infrastructures can no longer withstand disruption.
Contact us
Let the experts at PrivaPlan at info@privaplan.com provide more information about this report and learn how we can help you thwart cybersecurity threats like this.
