This devious ransomware is spreading through fake Tripadvisor complaints
Restaurant owners are being targeted by redesigned ransomware in a new campaign that impersonates TripAdvisor, experts have found.
Cybersecurity researchers from Sophos found a new phishing campaign in which victims are getting emails claiming to come from TripAdvisor and holding complaints from customers. The emails will try to deliver an attachment named “TripAdvisorComplaint.zip” which, if downloaded, will either hold an executable file called “TripAdvisor Complaint – Possible Suspension.exe”, or an HTML file of a similar name.
It’s business as usual for hackers distributing malware via emails – the contents are meant to create a sense of urgency and disaster with the victim, so that they don’t act rationally and don’t think before downloading the files.
Paying with Bitcoin
Those that fall for the trap and run the HTML file will suffer a Browser-in-the-Browser type of attack, and will think their browser opened a window to TripAdvisor, where they can read the complaints submitted to their restaurant. The “Read complaint” button will download an Excel XLL file called “TripAdvisor_Complaint-Possible-Suspension.xll” which, in turn, runs the Knight Lite ransomware encryptor.
The encryptor does the usual – encrypts the file and leaves a ransom note, demanding $5,000 in Bitcoin in exchange for the decryption key. BleepingComputer says that multiple victims got the same Bitcoin address in their ransom note, which only adds further risk to the payment – there’s no way of proving who made the payment, and someone else can swoop in and claim the payment (and the decryption key) for themselves.
The good news is that by press time – no one seems to have paid the ransom demand. The Bitcoin address – 14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z – currently has no funds and nothing in the transaction history. The ransomware leak site is also empty, BleepingComputer found.
The Knight Lite ransomware encryptor is a rework of the Cyclops ransomware-as-a-service, which launched in May 2023 and rebranded a few months later. The encryptors are available for Windows, macOS, and Linux.
Via: BleepingComputer
Restaurant owners are being targeted by redesigned ransomware in a new campaign that impersonates TripAdvisor, experts have found. Cybersecurity researchers from Sophos found a new phishing campaign in which victims are getting emails claiming to come from TripAdvisor and holding complaints from customers. The emails will try to deliver an…
