Beware: A Dangerous Windows 10 Ransomware Scam Is Spreading Online

[x16wda]

Just in time for the new week, we have this from fosshub.

We have bets in at work on which client will report this to us first after honkling their file server... (honkling = a whole letter worse than just honking a box...)

According to the Cisco’s security team, they have found a new scamming campaign that spreads CTB-Locker ransomware. This trouble comes in the form of a fake Microsoft email, telling Windows users that their Windows 10 download is ready.

These messages in Windows 10 ransomware scam mimic the emails sent by Microsoft, along with some text mistakes and changes. However, scammers have managed to spoof the address of origin as [email protected]. To make the messages look more authentic, attackers are using the same color scheme used by Microsoft to fool the users. Thus, these emails look more legitimate.

[Stoic Joker]

Well that didn't take long.

[TaoPhoenix]

Anyone want to summarize a "magic bullet" method of separating the fake ones from the real ones?

I could see myself falling for that with a spoofed address because my best main method (besides look and feel) of telling phishing is hovering over the address that says things like "Microsoft" (from werwfdsf.thai) or something.

[KynloStephen66515]

Just in time for the new week, we have this from fosshub.

We have bets in at work on which client will report this to us first after honkling their file server... (honkling = a whole letter worse than just honking a box...)

According to the Cisco’s security team, they have found a new scamming campaign that spreads CTB-Locker ransomware. This trouble comes in the form of a fake Microsoft email, telling Windows users that their Windows 10 download is ready.

These messages in Windows 10 ransomware scam mimic the emails sent by Microsoft, along with some text mistakes and changes. However, scammers have managed to spoof the address of origin as [email protected]. To make the messages look more authentic, attackers are using the same color scheme used by Microsoft to fool the users. Thus, these emails look more legitimate.

-x16wda (August 03, 2015, 05:27 AM)

Ahh gotta love misleading information - It has sweet-FA to do with Windows 10 - It's just randomware...it will cripple you on ANY OS...In fact, it doesn't even target people ON Windows 10 (Unless people are stupid enough to click it) as it is designed for those who have NOT updated yet...so...if anything....it has NOTHING to do with Windows 10 other than it's trying to grab people who would be upgrading to it...

Facts...they are not hard to understand.

[Stoic Joker]

Anyone want to summarize a "magic bullet" method of separating the fake ones from the real ones?

-TaoPhoenix (August 03, 2015, 09:24 AM)

The fake one has a .zip attachment.

[Stoic Joker]

It has sweet-FA to do with Windows 10 - It's just randomware...

-Stephen66515 (August 03, 2015, 09:31 AM)

While basically true, the reality is it's leveraging the confusion surrounding the new-fangled Windows 10 upgrade delivery system to get people to launch it.

[KynloStephen66515]

It has sweet-FA to do with Windows 10 - It's just randomware...

-Stephen66515 (August 03, 2015, 09:31 AM)

While basically true, the reality is it's leveraging the confusion surrounding the new-fangled Windows 10 upgrade delivery system to get people to launch it.

-Stoic Joker (August 03, 2015, 11:08 AM)

Yeah, but what strikes me, is everybody (news outlets included) are reporting it, as if it is a problem WITH Windows 10 itself, rather than really making it obvious (without reading in depth) that it is an e-mail scam.  For most of the internet (sigh) the truth is simple...they will read a headline on Facebook, or a news website, and see stuff like "A Dangerous Windows 10 Ransomware Scam Is Spreading Online" which instantly makes people jump to the conclusion that Windows 10 is evil and will cause you to lose all your files.  It's like saying "GTA V files found to contain terrorist training materials"...when the true story is really that some torrent purporting to be GTA V, contains those files...And although yes, the headline is theoretically true...it gives the complete wrong indication as to wtf is really going on.  It really should read something like "E-Mail scam targets those who haven't upgraded to Windows 10" (Or something along those lines)...but sadly...the world we live in requires the people who write these stories, to make them as obscure as possible, with a clickbaity style header, making people want to jump to conclusions and share the story based on nothing but guess work

[CWuestefeld]

Anyone want to summarize a "magic bullet" method of separating the fake ones from the real ones?

-TaoPhoenix (August 03, 2015, 09:24 AM)

Check for spelling and grammar errors. I have never seen a phishing or scam email that didn't have such errors. But a company like MS is going to have everybody from their marketing department to their lawyers proofreading anything they send, it's not going to have such errors.

It seems that the folks who engage in scams like this are the kind of people who think they can get by without having to do their own work, and so they never did their own studying back in school, either.

[KynloStephen66515]

Anyone want to summarize a "magic bullet" method of separating the fake ones from the real ones?

-TaoPhoenix (August 03, 2015, 09:24 AM)

Check for spelling and grammar errors. I have never seen a phishing or scam email that didn't have such errors. But a company like MS is going to have everybody from their marketing department to their lawyers proofreading anything they send, it's not going to have such errors.

It seems that the folks who engage in scams like this are the kind of people who think they can get by without having to do their own work, and so they never did their own studying back in school, either.

-CWuestefeld (August 03, 2015, 02:26 PM)

Well, tbh, when it comes to this...As far as I am aware, they don't e-mail you shit to click to download - They just download it to your PC if you pre-ordered via the annoying popup, then it will give you an annoying popup to tell you it's done doing whatever it did.

It does specifically say, in that stupid popup, that when it is ready, that window will let you know - absolutely nothing about "We will e-mail you" - So...if people didn't read that, they may as well go ahead and collect that prize for being the #1,000,000 visitor, help that Saudi Prince get access to his funds by sending him $1000, buy some of that tasty Viagra, partake in some penis enlargement pills and play the Nigerian Lottery.

[tomos]

Well, tbh, when it comes to this...As far as I am aware, they don't e-mail you shit to click to download - They just download it to your PC if you pre-ordered via the annoying popup, then it will give you an annoying popup to tell you it's done doing whatever it did.

It does specifically say, in that stupid popup, that when it is ready, that window will let you know - absolutely nothing about "We will e-mail you"

-Stephen66515 (August 03, 2015, 02:35 PM)

dont be too quick of the mark there Stephen - I got asked when I 'reserved' my copy, if I wanted email notification.

[Stoic Joker]

Well, tbh, when it comes to this...As far as I am aware, they don't e-mail you shit to click to download - They just download it to your PC if you pre-ordered via the annoying popup, then it will give you an annoying popup to tell you it's done doing whatever it did.

It does specifically say, in that stupid popup, that when it is ready, that window will let you know - absolutely nothing about "We will e-mail you"

-Stephen66515 (August 03, 2015, 02:35 PM)

dont be too quick of the mark there Stephen - I got asked when I 'reserved' my copy, if I wanted email notification.

-tomos (August 03, 2015, 03:05 PM)

Bingo! Combine an old scam with a new confusion and the fun ensues promptly at click here. Sure, I get where he's coming from...but folks need warned to think before they click.

[KynloStephen66515]

Well, tbh, when it comes to this...As far as I am aware, they don't e-mail you shit to click to download - They just download it to your PC if you pre-ordered via the annoying popup, then it will give you an annoying popup to tell you it's done doing whatever it did.

It does specifically say, in that stupid popup, that when it is ready, that window will let you know - absolutely nothing about "We will e-mail you"

-Stephen66515 (August 03, 2015, 02:35 PM)

dont be too quick of the mark there Stephen - I got asked when I 'reserved' my copy, if I wanted email notification.

-tomos (August 03, 2015, 03:05 PM)

Bingo! Combine an old scam with a new confusion and the fun ensues promptly at click here. Sure, I get where he's coming from...but folks need warned to think before they click.

-Stoic Joker (August 03, 2015, 04:49 PM)

That could be said for any e-mail you ever get, from anybody...ever 

[x16wda]

Part of the delight is that Microsoft never mentioned (at least in anything I saw) just what this notification would look like. I even did a quick search, and couldn't find a picture. I went ahead and pulled down all 5 of the ISOs I need and have worked from there, but just got the notification on my main box. And in case you haven't yet seen it, the "Windows 10 Upgrade is Ready Notification" looks like.... this:

Beware: A Dangerous Windows 10 Ransomware Scam Is Spreading Online

[KynloStephen66515]

Part of the delight is that Microsoft never mentioned (at least in anything I saw) just what this notification would look like. I even did a quick search, and couldn't find a picture. I went ahead and pulled down all 5 of the ISOs I need and have worked from there, but just got the notification on my main box. And in case you haven't yet seen it, the "Windows 10 Upgrade is Ready Notification" looks like.... this:
 (see attachment in previous post)

-x16wda (August 03, 2015, 06:49 PM)

I was/am far too impatient...so I downloaded it on release day before the notification came up (My Mrs's laptop still ain't had a notification...and I'm far too lazy to manually upgrade hers lol)

[4wd]

(My Mrs's laptop still ain't had a notification...and I'm far too lazy to manually upgrade hers lol)

-Stephen66515 (August 03, 2015, 07:20 PM)

That's not laziness, that's your latent self-preservation instinct awakening.

Trust me, I know

Rule #1: Never, ever, touch the wife's computer until you have been given permission ... and even then, don't.