Researchers at a number of Internet security firms have discovered a surge in JavaScript spam emails in recent months. The emails are being used to download Locky ransomware onto users’ devices and the problem is getting more severe.
The volume of JavaScript spam emails is increasing, as is the frequency of spam email campaigns. The attacks first started in early February, spiking in March/early April. There was something of a lull around the middle of April, yet by the end of the month the campaigns started again at an increased level. Volumes of JavaScript spam emails continued to rise throughout May.
JavaScript Spam Emails Being Favored by Spammers
The latest wave of JavaScript spam emails is being sent from IP addresses in India and Vietnam, and while the United States and Canada have not escaped, the emails are predominantly being used to target users in Europe. The emails contain a ZIP file containing malicious JavaScript files. If the user opens and unzips the file and opens a file, the JavaScript is executed and silently runs via the Windows Script Host Service (WSH) and downloads an intermediate malware known as JS/Danger.ScriptAttachment. This malware will then download Locky ransomware, although the attackers could easily update the campaign to deliver different malicious payloads. One security firm has reported that the wave of JavaScript spam emails is the biggest spam email campaign seen in recent years.
There are no known fixes for Locky ransomware infections. If Locky is installed on a computer, the users’ only defense is to restore encrypted files from a backup or face losing them permanently. This campaign masks the JavaScript with a XOR encryption algorithm to reduce the likelihood of detection.
Spike in Spam Emails Containing Malicious Office Macros
Combo Threat Research Labs also detected a surge in spam emails on May 17, with the campaign lasting 12 hours. During this spam email blitz, more than 30 million messages were sent. While the aim of the attackers was to download Locky ransomware onto users’ devices, the gang behind this campaign used fake Amazon shipping notices rather than JavaScript spam emails.
The documents containing the shipping notices contained a malicious macro. In order to open the attached file, users were required to enable macros on their devices. Doing so would trigger a ransomware download. Email recipients who have their office settings configured to automatically allow macros to run are at particularly at risk, as simply opening the email attachment would result in Locky being downloaded onto their devices.
Proofpoint also recorded this spike in malicious spam emails, although the company put the total number of emails in the campaign at over 100 million, making this one of the largest spam email campaigns seen in recent years, and certainly one of the biggest campaigns of 2016.
The Amazon spam email campaign is being distributed using spam botnets on virtual machines and consumer devices. This campaign was notable because the attackers were able to manipulate the email headers. This made the messages appear legitimate to email recipients. Any email recipients who regularly use Amazon.com for purchases could easily be fooled into opening the file attachment.
The emails used the subject line: “Your Amazon.com order has dispatched” along with a code number, closely mimicking the emails sent up Amazon. The body of the email did not contain any text. If users want to find out which order the email refers to, they would need to open the file attachment. The emails also appear to have been sent from the Amazon.com domain, making it much harder for email recipients to determine that the messages are malicious spam.
Surge in Spam Email Highlights the Importance of Using Spam Filtering Solutions
Spam email may have been in decline in recent years, but the latest waves of attacks clearly demonstrate that criminal gangs have far from given up on the medium for delivering ransomware. Spam emails containing links to malicious websites have remained at a fairly constant level over the past few months, yet JavaScript spam emails and malicious macros have surged. These spam email spikes show just how important it is to use a robust spam filtering solution such as SpamTitan.
SpamTitan captures 99.97% of spam email and prevents malicious spam emails from being delivered to inboxes. Since malicious actors are getting much better at masking their messages and making them appear legitimate, it is essential to limit the volume that are delivered to end users rather than rely on individuals to be able to identify emails as spam.