Australia a major target of Nemucod malware

A new malware campaign disproportionately targeting markets including Australia downloads ransomware and other malware to an unsuspecting victim's PC.

The malware, JS/TrojanDownloader.Nemucod, has been discovered by ESET.

Nemucod is spread through phishing emails designed to get users to open a malicious attachment containing a JavaScript file that downloads and installs the malware.

Emails are cleverly disguised as invoices, notices of appearance in court or other official documents, each containing a malicious attachment.

Nemucod then downloads a range of other malware, consisting mostly of ransomware such as TeslaCrypt and Locky. This ransomware encrypts data on a victim's computer and demands a payment to decrypt it.

Both forms of ransomware use encryption standards similar to those used by financial institutions to secure online payments.

A map of the prevalence level of the Nemucod malware shows that Australia is among the more targeted nations. But Japan, the UK and parts of Europe are even more heavily targeted.

To protect against the threat posed by Nemucod, ESET recommends people avoid opening attachments in emails sent from unknown senders, regularly back up data and regularly install updates to their OS and other software used.

Some security technologies are also able to protect user devices against ransomware by actively blocking known processes.

Image courtesy of Christiaan Colen under CC