Security researchers observed that Ako ransomware is using malicious spam attachments to go after organizations’ networks.On January 14, AppRiver Senior Cybersecurity Analyst David Pickett contacted Bleeping Computer and told the computer self-help site that his company had observed Ako being distributed via spam email.Using subject lines such as “Agreement 2020 #1775505,” the attack emails instructed recipients to open a password-protected .zip archive in order to view an agreement. That archive contained an executable named “agreement.scr” that installed the ransomware upon execution.
Sample spam email distributing Ako ransomware. (Source: Bleeping Computer)Bleeping Computer first covered Ako ransomware on January 10 after a victim posted on the website’s forums about a new ransomware strain that had encrypted their Windows 10 desktop and Windows SBS 2011 server.SentinelLab’s Vitali Kremez analyzed the ransomware and found that it shared certain similarities with MedusaLocker, leading some to refer to the threat as “MedusaReborn.” But the malware authors who created the new crypto-malware strain denied any connection to MedusaLocker and said that Ako was their own product. Those individuals also confirmed that they stole data prior to Ako encrypting users’ files.At the conclusion of its encryption routine, Ako dropped a ransom note informing victims that their “network have been locked [sic].”
Ako’s ransom note. (Source: Bleeping Computer)Lawrence Abrams, creator and owner of Bleeping Computer, explains that Ako’s distribution method highlights the importance of organizations taking steps to defend themselves against malicious spam attachments. As quoted in his blog post:As spam is being used to spread the Ako Ransomware, everyone must be is trained ..
Support the originator by clicking the read the rest link below.
