GoldenEye, the ransomware that spreads in job applications

[G.O.G]

A team of researchers at security firm Check Point has discovered a ransomware campaign that is being disseminated through job applications.

Specifically, it is a virus known as GoldenEye, a variant of the Petya ransomware that was discovered in the month of March last year. This malware encrypted the hard drive and was noted for being very dangerous and difficult to combat.

The main difference of GoldenEye and Petya resides in the form in which the attack diffuses. According to the researchers, the new virus spreads via e-mail camouflaged in an alleged job application. The text of the email pretends to have been written by a person who presents as a candidate to access a job offer and contains two attachments.

The first one is a PDF document that contains a cover letter. This file has no malicious content, and its function is none other than to provide credibility and give confidence to the victim. The second file is an XLS document that has malicious macros, and asks the user to validate the permissions so that they can be executed.

In case the victim accepts the execution of the macros, GoldenEye will infect the computer and begin the encryption process of all files on the computer, to which the ransomware will add an extension of eight characters at random. From this moment, the user will lose access to any file, and when the process is finished, the rescue note will be displayed in TXT format.

After this, the malware will force the computer to restart and start encrypting the disk, much like Petya did. Once the encryption is complete, a rescue note will be displayed at boot level with a personal decryption code that the victim can use to access a Dark Web portal to send messages to cybercriminals and proceed with the payment of the ransom, which Is fixed at 1.3 bitcoins, which are about 1,100 euros to change.

GoldenEye has been detected initially in Germany, but it is not ruled out that it can spread to other countries. To avoid infection, be suspicious of the emails that you receive with these characteristics and do not authorize the use of macros in Excel or in Word.