| CERT Australia is warning that fake emails claiming to be from Australia Post and AGL are being used to spread ransomware to unsuspecting recipients.
The emails are being used to infect computers with the TorrentLocker ransomware, which criminals use to extort payment from users by encrypting files on a computer system and demanding a ransom for the key to unlock the files.
The fake AGL email has the subject line ‘Electricity usage’ and a number up to eight digits long. The email body includes an amount supposedly incurred for electricity usage charges and an ‘AGL reference number’ the same as the number cited in the email subject line.
The email incorporates two web links: one that purportedly directs users to the details of their usage charges and one that directs users to ‘view current bill’. However, anyone who clicks on either of these links risks infecting their computer with the TorrentLocker ransomware.
A screenshot of the fake AGL email is posted below:
The fake Australia Post email has the subject line ‘You have to update your shipping address’ and claims that a ‘mailman’ has not delivered a parcel because the recipient was absent. The email includes a web link that claims to direct the email recipient to a web page where they can print a label. A second web link claims to direct the recipient to ‘further information’. However, as with the fake AGL email, anyone who clicks on either of these links risks infecting their computer with the TorrentLocker ransomware.
A screenshot of the fake Australia Post email is posted below:
Staying safe
Prevention is the best means of staying safe from ransomware and other malicious software (malware) attacks.
- Use spam filters and be cautious when opening emails, especially if there are attachments.
- Make sure you are using a reputable security product.
- Make sure it is up-to-date and switched on.
- Make sure your operating system and applications are up-to-date.
- Run a full scan of your computer—regularly.
- Set and use strong and unique passwords.
- Set passwords on all your hardware devices (including modems and routers).
- Back up your data regularly, once a month for example or every week if you have a lot of information on your computer or network.
- Keep a backup copy of your data in a safe place, disconnected from your computer and the internet.
- Only visit reputable websites and online services.
- Most up-to-date security software should identify and block ransomware.
Recovery
The major problem with encryption based ransomware is that once your computer has become infected, the only way to safely recover your files is from a clean backup, assuming your backup has not also been encrypted. Stay Smart Online recommends you do not pay a ransom for the key as you may forfeit your money and still not receive your files. You may also be a target for further attacks in future as the criminals may specifically target those who are willing to pay the ransom.
If you have a clean back up of your data, you can use this to restore your files once you have re-established your system, free of infection. Stay Smart Online also recommends seeking professional, technical advice if you are unsure how to backup or restore your system.
Reporting cybercrimes
If your computer has been compromised, you can report the incident to the Australian Cybercrime Online Reporting Network (ACORN).
ACORN provides information on how to recognise and avoid common forms of cybercrime, such as hacking, online scams, online fraud, identity theft, attacks on computer systems and illegal or prohibited content, as well as offering advice to those who have fallen victim.
ACORN makes it easier and more convenient to report cybercrime to a law enforcement agency. |
