anti-virus Archives

The FBI has warned that fake online file converters are spreading malware, potentially leading to data theft, financial loss, and ransomware attacks.

Cybercriminals are creating fake file conversion websites which appear to offer free tools for converting documents, images, and other file types. Many people use these types of file converters to convert a PDF to a Word document, extract audio from video files, or change an image file to a more suitable format. However, instead of just providing a conversion service, these malicious websites are also infecting users’ PCs with malware.

This attack is especially dangerous as PC users regularly access file conversion websites, but they don’t realize that these sites could be dangerous. Once a visitor has their converted file, they assume all is well. Unfortunately, behind the scenes, much more is going on.

Converting Your Files into Malware

The fake file converter websites often appear in search engine results or through online ads, making them appear safe and legitimate. Some of the most recent ones to have been identified as being at risk include DocuFix and PDFixers. When a user visits one of these sites, they’re typically instructed to upload the file they want to convert. Once the file is uploaded, the website provides a download link for the “converted” file.

However, this file is not what it seems. Although the downloaded file may be a correctly converted file, it will also have malware hidden in it. As well as containing malware, these fake websites will also analyze files uploaded by users for sensitive data e.g. if someone has uploaded a PDF file containing financial information, the threat actors behind the website will be able to harvest this. In many cases, a correctly converted file isn’t even included in the available download, with malware such as Gootloader and Cobalt Strike being the only files on offer.

The impact of this malware can be catastrophic. Running quietly in the background, it can capture personal data, launch ransomware attacks, or even take control of the PC. Accordingly, all PC users need to tread carefully online.

Staying Safe from the Threat of Fake Converters

File converter websites are incredibly useful, but only when they’re the real deal and do exactly what they claim. However, as most internet users accessing these sites are busy working on something, they don’t always pay attention to the site they’re visiting. And this is where cybercriminals have an opportunity to exploit this trust. Therefore, it’s crucial that you understand these best practices for staying safe:

Only Use Trusted Sites: Never use a file converter website that you haven’t thoroughly researched. Always conduct a quick Google search for reviews of the website and carefully read the most recent comments. Even if you’re a regular user of a particular converter website, always double check that the URL is correct – many threat actors mimic official websites by changing a letter or two in order to appear genuine.
Be Cautious When Downloading: Always scan any downloaded files from the internet with your security software. These security tools are regularly updated to identify all new strains of malware and can stop you executing any malicious files. Additionally, if a file converter asks you to install further tools to convert your files, you should immediately stop.

For more ways to secure and optimize your business technology, contact your local IT professionals.

A malware infection is always bad news but imagine being infected with multiple strains at once. Welcome to the new threat of malware cluster bombs.

Researchers at the cybersecurity firm KrakenLabs have revealed the dangers of a new malware technique launched by Unfurling Hemlock, a new threat actor group. Their malware cluster bombs have been verified as active in at least 10 countries, but most Unfurling Hemlock’s targets have been US-based. This attack has also been active for some time, with evidence of the earliest infections going back to February 2023.

The mere concept of malware cluster bombs is enough to worry any IT professional, so that’s why we’re going to delve a bit deeper and discuss how you can keep your IT systems safe.

Understanding Unfurling Hemlock’s Attack

This new attack starts, as with many malware attacks, through malicious emails or malware loaders. It would appear, perhaps to cover their own tracks, Unfurling Hemlock are paying other hackers to distribute their malware. The initial attack is focused around a malicious file named WEXTRACT.EXE. Within this executable is a collection of compressed cabinet files, each of which contains a strain of malware.

The final part of the attack comes when all of the malicious files have been extracted and are executed in reverse order. Each cluster bomb is believed to contain multiple strains of malware, so while the number is varied, the impact is always significant. Among these malware strains are a cocktail of different attacks, with botnets, backdoors, and info stealers all detected so far. Unfurling Hemlock’s ultimate aim, aside from causing digital chaos, is unknown, but KrakenLabs believe the threat actor may be harvesting sensitive data to sell.

The malware cluster bomb approach is innovative and effective for two reasons: the opportunities for monetization are increased and the multiple strains in use mean that persistence is enhanced. Ultimately, dropping ten strains of malware onto one device is more likely to provide opportunities for threat actors than a single strain.

Staying Safe from Malware Cluster Bombs

It’s clear that malware cluster bombs represent a serious threat to your IT infrastructure, and that’s why you need to keep your defenses secure. You can put this into action by following these best practices:

Regular Software Updates: ensure that all software, including operating systems and applications, is regularly updated and patched. Automated patch management tools can help make this easier, and Windows allows you to set automatic updates for Microsoft apps. Regular updates protect against known vulnerabilities and exploits which malicious actors often target with malicious files.
Antivirus and Anti-malware Solutions: always use reputable antivirus and anti-malware software across your network. These tools should be regularly updated to recognize and handle the latest threats. High-level security solutions will provide real-time protection, scanning, and removal of malicious files. This is conducted by regular scans and monitoring to ensure potential threats are detected and dealt with promptly.

Employee Education: carry out regular training sessions for employees to recognize phishing attempts, suspicious emails, and other potential threats. Training should include best practices for safe internet use, identifying social engineering tactics, and reporting suspicious activities. Your employees are your first line of defense, so it’s crucial you reduce the likelihood of attacks due to human error.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

Fake File Converter Websites are Pushing Malware

Malware Cluster Bombs: A New Threat

Tag Archives: anti-virus