Malicious help files are spreading the resurrected CryptoWall ransomware again. This time it is being spread by malicious help files.



Hundreds of mailboxes are holding the malicious .chm attachments. .Chm is an extension of the Compiled HTML file format, which is used to deliver user manuals. Users can be exposed to an external URL after simply opening a .chm file.

BitDefender security analyst Alexandra Gheorghe, in a blog wrote: “Attackers began exploiting .chm files to automatically run malicious payloads once the file is accessed. And it makes perfect sense: The less user interaction, the greater the chances of infection.”

BitDefender found that the email blast appears to be coming from spam servers that appear to be in Vietnam, India, Australia, the US, Romania and Spain. Targets are those in the US, Europe and Australia.

As always, users should be wary of paying the ransom, should an infection occur, and should keep a copy of their important data backed up on external drives or to cloud storage.

Source: InfoSecurity