A booby trap image or video file is spreading in social networking sites and victims fall to Locky ransomware. The malware is distributed via Facebook and LinkedIn, which steals user information once the file is executed.
The infamous Locky ransomware has found a way of spreading itself through the use of social networking sites like Facebook and LinkedIn. The malware started spreading via email with a word document attachment which contains malicious macros.
Locky ransomware is a new strain of malware that scrambles user files and renames it with a different file extension, called locky. The only way to decrypt the victim's file is to pay ransom via a "dark web" using bitcoin.
According to Info Security, Check Point researchers discovered the Locky ransomware being spread using Facebook messenger with Scalable Vector Graphics or SVG file. The victim who is unwary about the image he/she received will click on the image. The victim will be directed to a fake YouTube website and will be asked to download a file before the victim can watch it.
Once the malware has been downloaded, the victim will then be asked to run the file to install it. Locky ransomware will now affect the victim's files on his/her computer with an encryption. To retrieve the files, the victim will have to pay a ransom amounting with one Bitcoin, which is equivalent to $736.
Check Point researchers have already warned Facebook and LinkedIn about its vulnerabilities, but it remains unfixed. The spam campaign of the Locky ransomware may not only stick with one file extension name. Previously, the malware used .Shit extension, .THOR extension and now it has .SVG extension, JS and HTA extension. It only means that it changes overtime whenever the culprits updated it, Bleeping Computer reported.
Meanwhile, the best way to stop spreading Locky ransomware is to stop forwarding unknown images or links to any of your friends if you received a suspicious file. If you have received one, don't click or open the link that it suggested you go to. If it's late and your computer is infected, don't pay any ransom since it will only support cyber criminals if you do.
