Another Wave of Malware Hits Europe, Mainly Downloading ‘Locky’ Ransomware, Ireland Affected

ESET finds Ireland among the top countries affected by new Danger.Script malware.

ESET LiveGrid® telemetry shows a spike in detections of the JS/Danger.ScriptAttachment malware in several European countries. The most notable detection ratios are seen in Luxembourg (67%), Czech Republic (60%), Austria (57%), Netherlands (54%) and the United Kingdom (51%), but Ireland follows closely with 46%.

After delivery as an email attachment and opened, the threat behind these detections is designed to download and install different variants of malware to victims’ machines.

If the user falls for the scam, JS/Danger.ScriptAttachment tries to download other malicious code, the majority of which consists of various crypto-ransomware families such as Locky. A detailed description of how Locky operates is available in a separate analysis.

“ESET users are protected from this threat. Our solutions are able to block its malicious intent to download and execute various ransomware families”, comments Ondrej Kubovic, ESET IT Security Specialist.

JS/Danger.ScriptAttachment has the same intentions as the Nemucod downloader that hit the internet globally in several waves; that also targeted Ireland heavily. ESET warned the public of the threat in late December, 2015, and again in March, 2016.

ESET considers ransomware one of the most dangerous computer threats at present, a fact that seems unlikely to change in the foreseeable future. Therefore, we recommend both private and corporate internet users keep their computers and software up to date, use reliable security software and regularly backup their valuable data.

Danger.Script prevalence levels:

Luxembourg: 67%
Austria: 57%
Netherlands: 54%
United Kingdom: 51%
Germany: 48%
Denmark: 48%
Ireland 46%
Sweden: 46%
Belgium: 45 %
Greece 43%
Spain: 42%
Finland: 42%
Norway: 40%
France: 36%
Portugal: 30%
Poland: 26%

[su_box title=”About ESET®” style=”noise” box_color=”#336588″][short_info id=’60260′ desc=”true” all=”false”][/su_box]