Subj : This devious ransomware is spreading through fake Tripadvisor com
To   : All
From : TechnologyDaily
Date : Mon Aug 14 2023 15:15:03

This devious ransomware is spreading through fake Tripadvisor complaints

Date:
Mon, 14 Aug 2023 14:01:28 +0000

Description:
Your restaurant isn't getting suspended from TripAdvisor, it's a ruse to get 
you to download malware.

FULL STORY
======================================================================

Restaurant owners are being targeted by redesigned ransomware in a new 
campaign that impersonates TripAdvisor, experts have found. 

Cybersecurity researchers from Sophos found a new phishing campaign in which 
victims are getting emails claiming to come from TripAdvisor and holding 
complaints from customers. The emails will try to deliver an attachment named 
TripAdvisorComplaint.zip which, if downloaded, will either hold an executable 
file called TripAdvisor Complaint - Possible Suspension.exe, or an HTML file 
of a similar name. 

Its business as usual for hackers distributing malware via emails - the 
contents are meant to create a sense of urgency and disaster with the victim, 
so that they dont act rationally and dont think before downloading the files. 
Paying with Bitcoin 

Those that fall for the trap and run the HTML file will suffer a 
Browser-in-the-Browser type of attack, and will think their browser opened a 
window to TripAdvisor, where they can read the complaints submitted to their 
restaurant. The Read complaint button will download an Excel XLL file called 
TripAdvisor_Complaint-Possible-Suspension.xll which, in turn, runs the Knight 
Lite ransomware encryptor. 

The encryptor does the usual - encrypts the file and leaves a ransom note, 
demanding $5,000 in Bitcoin in exchange for the decryption key. 
BleepingComputer says that multiple victims got the same Bitcoin address in 
their ransom note, which only adds further risk to the payment - theres no 
way of proving who made the payment, and someone else can swoop in and claim 
the payment (and the decryption key) for themselves. Read more 

> Ransomware is up significantly this year - is your business a prime target? 


 > A shocking number of businesses aren't getting their data back after a 
ransomware attack 


 > Here are the best endpoint protection tools right now 

The good news is that by press time - no one seems to have paid the ransom 
demand. The Bitcoin address - 14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z - currently 
has no funds and nothing in the transaction history. The ransomware leak site 
is also empty, BleepingComputer found. 

The Knight Lite ransomware encryptor is a rework of the Cyclops 
ransomware-as-a-service, which launched in May 2023 and rebranded a few 
months later. The encryptors are available for Windows, macOS, and Linux. 
Here's our rundown of the best firewall software 

Via: BleepingComputer



======================================================================
Link to news story:
https://www.techradar.com/pro/this-devious-ransomware-is-spreading-through-fak
e-tripadvisor-complaints


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.