Lt Col Montri Boonyayothin from the Technology and Information Centre (TIC) released a statement on Wednesday (April 29) warning people about the new wave of cybercrime.
He explained that the malware, similar to a trojan, is delivered in emails with a subject line containing the words “Account’, “Locked” or “Suspended.
The emails have attachments that may have a variety of extensions including .pdf, .xls, .ppt, .txt, .py, .wb2, .jpg, .odb, .abf, .js, .pl, .doc
It is spread from one vulnerable network to others. The payload locks the receiver’s computer and demands payment in Bitcoins of US$650 (B20,000) to the email sender in return for a code to unlock the computer.
He said that since last month the TIC had been told of or detected 82 cases of emails that contained the ransomware.
“We detected e-mails containing the malware that were sent to and distributed by a mail server in Thailand on April 29, resulting in many people complaining their computers had been locked.”
He warned that in addition to extorting money, the malware also gives to perpetrators access to all files and information on a computer and on any external drive attach to the computer, potentiaally allowing the perpetrators to rob internet-linked bank accounts.
The TIC advises anyone receiving an email like this from an unfamiliar sender not to open the email but to delete it immediately.
Ransomware is not new, but has spread particularly in the past two years. See here for more information.
The ransomware currently spreading in Thailand appears to be CTB Locker, which originated in Russia and the Ukraine. See here for more details.