This Ransomware Targets HR Departments with Fake Job Applications

 This is a great example how focused the bad guys are getting with their attacks, and you need to watch out for this social engineering attack vector year-round.

Cybercriminals are posing as job applicants as part of a phishing campaign to infect victims in corporate human resources departments with GoldenEye ransomware -and they're even providing a cover letter in an effort to lull HR people targets into a false sense of security.

A variant of the Petya ransomware, GoldenEye targets human resources departments in an effort to exploit the fact that HR employees must often open emails and attachments from unknown sources.

The initial email contains a short message from the fake applicant, directing the victim to two attachments. The first is a cover letter within a PDF which doesn't actually contain any malicious software, but is intended to reassure the target that they're dealing with a standard job application. However, the second attachment is an Excel file supposedly containing an application form but which in fact contains the malicious GoldenEye payload.

Upon opening the Excel attachment, the target is presented with a document which claims to be 'Loading' and requires them to enable Macros to view the file. When Macros are enabled, GoldenEye executes a code and begins encrypting the users' files before presenting them with a ransom note using yellow text -- rather than the red or green used by other Petya variants.

It's believed by researchers that the developer behind Petya ransomware is going by the alias Janus -- apparently borrowing the name of a cybercriminal group in the 1995 James Bond film GoldenEye.

Source: KnowBe4Blog.com