This threat is a malware downloader, a trojan that connects to an online server and downloads and runs other malware. When users download and open the archive, and execute the WSF file, a JScript function starts a series of operations that download and install a malware known as Crimace, detected as TrojanDownloader:JS/Crimace.A. The title is boring and mundane, but the email contains a file named 'Criminal case against you,' which might get some users' attention. In their most recent spam campaign, the ransomware's creators are using emails disguised as fax messages, using a subject such as 'PLEASE READ YOUR FAX T6931.' Microsoft's security team recently picked up a spike in activity from the group's operators. Since then, the number of infections with PClock has been low but steady. After that point, PClock victims could only restore their files from backup files or by paying the ransom. The ransomware, detected by Microsoft as Ransom:Win32/WinPlock.B or WinPlock, is more commonly referred to under the name of PClock and has been going around since January 2015, when users first complained about it on the Bleeping Computer forums.Įmsisoft security researcher Fabian Wosar was able to create a decrypter for the earlier versions that allowed users to unlock their files for free.īy May 2015, the PClock team updated their code and broke the decrypter. A new spam wave posing as emailed fax messages is delivering a malware downloader that fetches and installs a ransomware family known as PClock, a CryptoLocker clone.

Crypto locker names