From RAR to JavaScript: Ransomware Figures in the Fluctuations of Email Attachments

On Friday, I saw this article entitled and it talks about what I’ve been saying for awhile now. Ransomware is starting to come in with E-mail attachments from places you might expect shipping notifications from. You know what gets me about this? I know when I’m expecting a package, and usually I will either ask it to E-mail or text me, and it is from trhe site I’m expecting it to come from. These say something like UPS, and it’ll tell you that it couldn’t be delivered. The actor wants you to open the attachment for details. If there was a problem, it would be logged with the shipping company so when you called by phone, they could tell you what happened and you can reschedule it, or have it directed somewhere else. This reminds me of this article I talked about entitled Why Some Phishing Emails Will Always Get Through Your Spam Filter and these are some that will get through because it looks credible.

Why does it look credible?

• You may at the time of the E-mail be expecting a package.
• When you look at the E-mail, it might sound plausable seeing that it has been several days since you got a notice if you’ve requested one.
• The from says UPS/Fedex/DHL or other shipping company.
• The E-mail is signed by a supposed manager.

In the tech blogs post of phishing being a problem by coming in to your inbox, I posted such an E-mail i got saying the exact thing. I was not expecting any type of delivery, I looked at the E-mail address and it didn’t match any type of shipping company address.

Each shipping company has a typical pattern of shipping confirmation and tracking number. For example, the E-mail will greet you a certain way, UPS for example has shipping confirmations starting with 1z, and other characteristics that you need to be aware of if you receive packages in a regular basis.

While I’m not sure about other carriors, I know that Amazon will use their own, which an app like Delivered will not track.

If you have thoughts, please feel free to share them, we’re continuing to track this as a problem, and I at least, want to pass my experience on. I hope this helps.