To Spread Jaff Ransomware Botnet Sending 5 Millions E-mail Per hour

By Prempal Singh 0 Comment May 18, 2017  anti ransomware, cerber, cryptolocker, cryptolocker ransomware, decrypt ransomware, fbi ransomware, kaspersky, locky, locky ransomware, Malware, malware ransomware, malwarebytes, malwarebytes ransomware, ransom, ransomware attack, ransomware cerber, ransomware decryptor, ransomware download, ransomware kaspersky, ransomware removal, remove ransomware, virus, virus ransomware, what is ransomware, windows ransomware

A tremendous malicious email attack that stock from the Ne-curs botnet which is increasing a new ransomware at the rate of 5, 000, 000 emails per hour and hitting computers across the globe.

Dubbed “Jaff,  the new document-encrypting ransomware is nearly the same as the notorious Locky ransomware in many ways, but it is more demanding 1. 79 Bitcoins (approx $3, 150), which much greater than Locky, to unlock the secure files on an afflicted computer.

According to security analyst at Force point Protection Lab, Jaff ransomware, written in C programming languages, is being distributed by making use of Ne-curs botnet that presently controls over 6, 000, 000 affected computers worldwide.

Ne-curs botnet is sending e-mails to millions of users with an attached PDF file document, which if clicked on, opens up an embedded Word files with a malicious macro script to install and execute the Jaff ransomware, Malware-bytes says.

Jaff is Spreading at the Rate of 5 Million per Hour

The malicious email attacks started on Thursday early morning at 9 am and had peaked by 1 pm, as well as system registered and blocked more than 13 million emails during that period – that is 5 Million emails every an hour.

“Jaff focuses on 423 file extensions. It can be capable of offline security without dependency on an order and control machine. Every file is protected, the ‘Jaff’ record extension is appended,  Force point says.

The ransomware places a ransom note in every damaged folder even though the desktop backdrop of the affected computer is also replaced.

The ransom note tells sufferer that their files are encrypted but does not ask them for any installment instead, it urges sufferer to visit an installment portal located on a Tor site, which is accessible via Tor Internet browser, in order to get decrypt their important data files.

Once sufferer installs Tor Browser and examines the secret site, there they are then asked for a great 1.79 BTC (about $3, 150).

The separate analysis conducted by Proof point analyst indicated that the Jaff ransomware could be the work of the identical cyber criminal team behind Locky, Dridex, and Bart.

The safety company said that the Raff ransomware campaign had damaged users globally with mostly sufferer organizations in the United Kingdom and the United States, as well as Ireland, Belgium, France, Germany, the Netherlands, Italy, Mexico and Australia.

Substantial Ransomware Attack Uses NSA’s Windows Utilize

In the distinct news, another massive fast-spreading ransomware attacks are focusing on computers at Hospitals, Financial companies, Telecom and Organizations across the globe today.

The ransomware, which is known as WanaCypt0r or Wanna-cry, is using NSA’s Windows exploit, Eternal-blue, which has been discharged by Shadow agents hacking group over the month ago.

Inside just hours this internet attack has infected more than 60, 000 computer systems in 74 countries.

How can you secure yourself from the Jaff Ransomware?

To protection against such ransomware infection, you should always be disturbed about uninvited data files sent a message and should never hit on links inside those data files unless confirming the source.

Verify if macros are disabled in your Microsoft Office software. If not, block macros from running in Business office files on the internet. In corporations, your system administration can set the default environment for macros.

To always have a tight grasp on your entire important data files and documents, keep a good backup routine in place which enables their replications to an external storage space device that is not always linked to your PC.

Moreover, ensure that you run an active anti-virus security company of tools on your system, and most dominantly, always surf the Internet safely.

Source: thehackernews.com