Attacks Disguise Malware as Student Assignments
Researchers have identified a new security risk that takes advantage of remote learning to launch a ransomware attack from a teacher’s computer. The attack attempts to trick teachers into opening fake student assignments, which, when opened, can download, install and activate the malware.
The attack, from a person or group calling themselves “employer21,” emails a fake assignment to a teacher. The assignment, according to researchers at Proofpoint, contains macros that, when activated, will download and run software that encrypts files on the victim’s computer. A notice then opens up demanding $80 in bitcoin.
Email-based attacks by employer21 were observed in early October. As of the publication of Proofpoint’s report, it appeared no bitcoin payments had been received.
According to the report: Students and school systems have faced unique problems in 2020, and these messages take advantage of widespread technological difficulties accompanying online learning. The messages are well crafted with a clear understanding of what would appeal to recipients, though as of this writing, Proofpoint researchers have not observed any payments posted to the ransom note Bitcoin address. While this campaign was very small, it’s possible that this and other actors will continue using themes of technology issues and online learning to lend legitimacy and urgency to their lures.”
A complete breakdown of the employer21 malware can be found on Proofpoint’s site.