Comments

Spoofed copier@ your own email address Attached document malspam delivers Locky ransomware again today — 1 Comment

  1. We have started getting different ones from the same campaign.
    —————————————–
    Date: Fri, 16 Dec 2016 16:53:57 +0530
    From:
    To: [REDACTED]
    Cc:
    Subject: Message from “RNP002B2C6F359E”
    Attachment: 201612161653576693_001.docm(45711byte) This E-mail was sent from “RNP002B2C6F359E” (Aficio MP 2352).

    Scan Date: Fri, 16 Dec 2016 16:53:57 +0530)
    Queries to: donotreply@[ourdomain]
    —————————————–
    We do receive scanned documents with the same subject line (different RNP though)
    Must be the same crowd sending these as the payload dowload locations are
    mgascca.com/hjg766
    medianisprint.com/hjg766
    ivibohoc.url.ph/hjg766
    nonblockservice08.info/hjg766

Leave a Reply

Your email address will not be published. Required fields are marked *