Hacker News Reader

Full thread

schoen

A different hypothesis on the tor-talk list was a piece of ransomware that generates a hidden service per victim:

https://lists.torproject.org/pipermail/tor-talk/2016-Februar...

View on HN

Exactly my first reaction.

At the moment we get hundreds of Locky mails per day.

There is a huge spike in ransomware at the moment. And all ransom has to be paid via a tor location.

We started blocking .docm at the mail server (it uses a Word macro to download)

That won't block all macro viruses. You need a dedicated program/firewall for this, filtering on extension won't work. Older .doc formats can also have macro's included and will work in newer (as well as older) versions of word.

This was just to prevent this specific attack - kind of a stopgap until the AV detects it properly.

IIRC last time I checked the Word doc on virustotal it was picked up 22/55.

Fortunately at least AV did pick up the payload when a user let the macro run...

Edit, ran it by virustotal again and got 28/55

- https://twitter.com/GossiTheDog/status/700370444902391808

- https://twitter.com/GossiTheDog/status/700370867352637440

Reply on news.ycombinator.com