Locky ransomware spreading on Facebook cloaked as .svg file

Radu Tyrsina has been a Windows fan ever so since atomic number 2 got his first PC, a Pentium III (a monster at that clip). For most of the kids of his age, the Cyberspace was an... Read Sir Thomas More

Spamming and ransomware are the most common forms of cyber crime encountered today. FBI records suggest that there has been $1 billion of money secured aside cyber criminals in 2016 alone. As dangerous and untraceable as these crimes may be, encountering them on familiar, trusted sites cause them even more touch-and-go. This clock, spammers cause targeted Facebook.

Facebook has been asterisked quarantine after falling prey to a ransomware attack that has spread like wildfire over the cultural network. The notorious junk e-mail take the field involves the spreading of the Nemucod malware downloader among users, which in some cases was seen downloading the Locky ransomware. To go far still worse, there is no free decryption program available for Locky.

Locky ransomware is known to lock up an infected computer, encrypt its files so hold them redeem for a Bitcoin payment. There is still no concrete solution developed for Locky's encoding so users have littler hopes of ever ill the damage.

The threat was blemished by two security staff office specialistic in cyberspace-settled crime and malware, Baronet Blaze. who handles Threat Intelligence for international financial services company PricewaterhouseCoopers and Peter Kruse. an eCrime specialist for the Danish CSIS Security Type A/S. The peril was generated in the class of spam messages feast via Facebook's IM system.

The computer virus evaded Facebook's whitelisting by simulation to be a .SVG image file and was sent from compromised Facebook accounts. The infected files, different other average file types, sustain the ability to turn back enclosed placid like JavaScript and buns be opened in a modern browser. The reason the crooks opted to share SVG images is because IT is XML-settled and allows propelling content so it was easier to cloak JavaScript code right inside the photo itself, which in this case was a connec to an external file.

Opening the infected file redirects users to a spammy site, a copycat version of YouTube. The website doesn't raise some red flags until it prompt users to install a malicious codec Chrome elongation in order to lookout man the video. Upon allowing, the uncorroborated extension volition give it the capability to alter drug user' information regarding the sites they confabulate.

As reported by Blaze, the extension will also go around the malware farther along Facebook, compromising the victim's account. The spammers can take over your account and further spread the malware among your social media friends by sending them spammy messages with the same SVG image file.

Safety Measures

For starters, and this one is bad obvious:fare not click any SVG file. If your close ones send you a message with the ransomware attached, you should monish them ASAP about their account being compromised.

Deny installing the Chrome extensionand even if you do in some way click on the SVG file, one right smart to revert information technology is to go to the menu, navigate to 'Extensions' via Prime More Tools, find the extension and and then remove itbefore Necumod infects your system.

The next whole tone would atomic number 4 to download a omnipotent internet surety package. System Looker is one of the most tested tools to tackle the problem, developed past Kaspersky Lab. System Watcher is available on complete of Kaspersky Lab's main products like Kaspersky Anti-Virus, Kaspersky Internet Security, and the ultimate in computer security, Kaspersky Total Security.

But if you have gone past times this, the guard ship has sailed and the most you can do nowwipe your hard parkway to do away with the Locky ransomware and be Sir Thomas More judicious about strange Facebook images next time.

RELATED STORIES YOU NEED TO Bridle OUT:

Mind: Karma ransomware cloaks itself as helpful utility program
Ransoc is a bold ransomware that threatens legal action if you don't pay
Zepto ransomware is back, Windows Defender can't block it