Extortion virus campaign impersonating the Prosecutor's Office targets Hungarian companies
The NBSZ NKI has issued an alert: unknown attackers are sending fake prosecutorial letters to distribute ransomware in Hungarian company systems, demanding ransom payments.
Ransomware spreads to Hungarian companies via fake prosecutorial letters
The National Cyber Security Institute of the National Security Service (NBSZ NKI) has issued an alert concerning an active phishing campaign, according to reports by Telex. The attackers are misusing the name and visual elements of the Prosecutor's Office of Hungary to send messages leading to ransomware infections to Hungarian organisations.
The letters reference the initiation of official criminal proceedings and display the names of prosecutors' office employees as senders. In reality, they all originate from a fake email address ending in @outlook.hu – the Prosecutor's Office uses the @mku.hu domain for genuine communications. The subject lines of the letters vary; typical wording includes: "Information regarding criminal proceedings materials available in the case of [Company name]".
The message contains a Google Share link that redirects to a deceptive webpage that appears official at first glance. In the browser address bar, a falsified link beginning with ugyeszseg.hu is visible.
The page encourages the target to click further, which triggers the download of the malicious file and the encryption process. After locking the files, the ransomware adds a "LOCKED_" prefix to the filenames, while the file extension remains unchanged. According to the displayed message, the attackers provide a .onion-based contact address and claim that only they are capable of restoring the data, the NKI reported.
The campaign affects documents, images, archives and other types of files alike.
Source: Telex