Necurs Botnet Distributing Large Amounts SPAM Emails Containing Locky Ransomware

Threat Intelligence monitoring has identified that the Necurs botnet has been distributing large amounts of SPAM emails containing Locky Ransomware.

Threat ID:: CC-1486
Category:: Ransomware, Botnet
Threat Severity:: Medium
Threat Vector:: Email spam
Published:: 22 June 2017 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Threat Intelligence monitoring has identified that the Necurs botnet has been distributing large amounts of SPAM emails containing Locky Ransomware.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Malicious spam email have been witnessed with the following subject lines:

PDF-N*
Document-N*
Copy-N*

Necurs is a large botnet that is known to distribute various types of malware, including; banking trojans and ransomware.

Remediation steps

Type	Step
	Keep malware definitions up-to-date. Never open email attachments or click on links from untrusted sources (Guidance on how to identify Spam/ Phishing emails within the NHS.) Make sure that cyber awareness training is kept up-to-date Report spam emails to [email protected] using the following process: Reporting suspicious/unsolicited/spam emails within the NHS

Last edited: 15 December 2021 9:44 am