Researchers at SophosLabs are analysing a new ransomware attack that appears to have hit computer users via a drive-by vulnerability on compromised websites.

Malicious hackers are spreading the ransomware, which encrypts media and Office files on victim’s computers, in an attempt to extort $ 120. In a nutshell – you can’t access your files because the malicious code has encrypted them (in our observations, the whole file isn’t encrypted – just the first 10% or so), and the hackers want you to pay the ransom if you want your valuable data back.

The attack, which Sophos detects as Troj/Ransom-U, changes your Windows desktop wallpaper to deliver the first part of the ransom message.

The main ransom demand is contained in a text file:

Attention!!!

All your personal files (photo, documents, texts, databases, certificates, kwm-files, video) have been encrypted by a very strong cypher RSA-1024. The original files are deleted. You can check this by yourself - just look for files in all folders.

There is no possibility to decrypt these files without a special decrypt program! Nobody can help you - even don't try to find another method or tell anybody. Also after n days all encrypted files will be completely deleted and you will have no chance to get it back.

We can help to solve this task for 120$ via wire transfer (bank transfer SWIFT/IBAN). And remember: any harmful or bad words to our side will be a reason for ingoring your message and nothing will be done.

For details you have to send your request on this e-mail (attach to message a full serial key shown below in this 'how to..' file on desktop): [email address]

The HOW TO DECRYPT FILES.txt file gives an email address to contact if you wish to recover your data. In addition, there is a fingerprint hex-string in the file which changes between successive runs – the message says that victims must quote this string when making contact (presumably it is related to the actual key used for decryption).

Users have reported to us that they have received the attack via a malicious PDF which downloads and installs the ransomware. Sophos detects the PDF as Troj/PDFJS-ML.

Files with the following extensions can be affected: .jpg, .jpeg, .psd, .cdr, .dwg, .max, .mov, .m2v, .3gp, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .rar, .zip, .mdb, .mp3, .cer, .p12, .pfx, .kwm, .pwm, .txt, .pdf, .avi, .flv, .lnk, .bmp, .1cd, .md, .mdf, .dbf, .mdb, .odt, .vob, .ifo, .mpeg, .mpg, .doc, .docx, .xls, and .xlsx. The easiest way to identify files that have been meddled with is that their filenames will have been changed to include the suffix “.ENCODED”.

Of course, we don’t recommend paying money to ransomware extortionists. There’s nothing to say that they won’t simply raise their ransom demands even higher once they discover you are prepared to pay up.

Once again, users who make regular backups of their important data have good reason to pat themselves on the back.

• LizaMoon the Latest SQL-Injection Attack
  Working in the security industry brings about a myriad of challenges. This is especially true for vendors. We must do our best to educate and inform. At the same time, we want to avoid laying on the F...
• More on the “massive” SQL injection attack
  Alas, the news was published on April 1st. But it is not a joke. Curious, I spent a bit of time today researching it (when I really was supposed to be doing other things), and while the “lizamoon” ...
• LizaMoon, Etc. SQL Injection Attack Still Ongoing
  We’re currently monitoring a still-ongoing mass compromise involving a great number of websites. The compromised sites have been injected with a malicious script that triggers redirects to certa...
• Italian model exposed in Facebook clickjacking attack
  The mere mention of anything with a sex connotation on Facebook almost always begets some major activity, with people wanting to know more. As a result, whatever the attack vector or channel might be ...
• Attack Using CVE-2011-0609
  Attackers have been taking advantage of the situation in Japan to trick their targets into opening malicious files. These cases have used infected Excel attachments with Flash exploits. Here's a sc...
• Phishing Attack Uses Fake Donation Website
  Earlier today, we found a phishing site that poses as a donation site to raise money for the victims of the recent earthquake in Japan. The phishing site http://www.japan{BLOCKED}.com is created by us...
• Anatomy of an Attack: Dallas, TX and Louisville, KY
  It is with great joy that I announce the next two live Anatomy of an Attack events we will be delivering in Dallas, TX and Louisville, KY. What is Anatomy of an Attack? It's a half-day seminar where I...
• Data leakage and dictionary attack stories from RSA
  Last year, I wrote several Naked Security articles about computer security problems which can put travellers in harms' way. The topics I covered were: * The free WiFi service at San Francisco airport ...
• RSA Conference 2011 – Live Malware Attack, and Most Educational Security Blog!
  Apologies to our readers from me and from Chester Wisniewski - we haven't written anything for Naked Security for the past week or so. That's because we've been off the air, and on our feet, for the ...
• “porn sex free site” spam attack on .edu sites
  There seems to be a rather nasty spamrun taking place on many .edu sites hosting forums at the moment. Filtering out lurid trackback spam and genuine .Edu articles about pornography in ...