Cerber Macro-Based Ransomware on the Move to Office 365 Users

Macros are at it again. Specifically the ransomware Cerber and various versions of it are targeting Microsoft Office 365 users. Malicious phishing emails are sent that if the macros within the attachment are enabled, will unleash ransomware on the user’s machine.

This malware exploits a zero-day vulnerability that was detected in late June.  The Cloud security company that announced this finding (Avanan) said that the attackers tried sending messages to 57% of its customers using Office 365. They do not know how many actually executed the malware.

Phishing emails contain malware like this one, Locky, and Dridex more and more these days. These are macro-based malware, which requires the user to either have macros enabled or will request the user enable them upon opening the attachment. However, doing so can let lose something very nasty and potentially cost hundreds, if not thousands of Dollars or more to decrypt your files. In this case, the ransom is 1.24 Bitcoin, which is somewhere between $700-800 depending on exchange rates.

Macros are disabled by default in newer versions of Microsoft Office. However, it is not in the older ones. Take some time to check your settings and disable them by default. Never enable macros unless you have created them yourself or you know who did and are 100% certain they are safe.  Beware of popup or warning message fatigue. This happens when we are inundated with messages on our screens and just click something to make them go away. This is dangerous. Take some time to read them before clicking them off the screen.

Remember that a key to identifying phishing is if the message contains an attachment or link that is unexpected. If you were discussing a file with a colleague or friend earlier that was to be sent, then the risk of it containing something malicious is much lower. However, if something arrives out of the blue or from someone you don’t know, it should be met with considerable suspicion. If you have any doubts at all, verify it with the sender in some way other than hitting reply.

This particular ransomware campaign began in late-June. However, don’t expect it and others like it to disappear any time soon. Macro-based attacks are still very effective. Those wanting to profit from it aren’t likely to let up. Make sure you have a recent backup of your important files at all times. Just in case you accidently infect your device, that’s a great way to avoid paying a ransom and still get your information back.