ATTENTION! INTRUDERS ARE SENDING THE TROJAN BY E-MAIL

Computer Emergency Response Service - KZ-CERT warns of sending emails containing links to malicious programs by the intruders.

Since September 2015, Internet users began to receive e-mail messages, the sender of which supposedly is a legal entity, which is a tax audit. The letters have the «Documents» heading:

«Hello!

There is a tax audit in our company. We do not have any contract and invoice-factura with you.

Please kindly sign, scan and send it to us today. Archive is attached.

Link to download the files (specified malicious links)

The files will be stored for up to 24.10.2015».

Following the link, the user automatically downloads the malicious file «Dokumenti dlya nalogovoi.scr», which has an icon of Word document to put it across the user regarding the true contents of the file.

Using scr file extension, which many users are not considered as dangerous are not always the extension (unlike .exe and .com) is controlled by automatic control systems (for example, the control downloads to a proxy server, etc.).

Many products detected the objects named Cryakl (Criakl) - one of the modern Trojan cryptographers.

This cryptographer is very dangerous, because at the moment is not always possible to decrypt the encrypted data to them.

A list of file extensions that are subject to encrypt the data of malicious objects:

113, 1cd, 3gp, 7z, accdb, arj, asm, bak, cdr, cer, cpt, csv, db3, dbf, doc, docx, dt, dwg, fbf, fbk, fbw, fbx, fdb, gbk, gho, gzip, jpeg, jpg, key, keystore, ldf, m2v, m3d, max, mdb, nbd, nrw, nx1, odb, odc, odp, ods, ods, odt, old, orf, p12, pdf, pef, ppsx, ppt, pptm, pptx, pst, ptx, pwm, pz3, qic, r3d, rar, raw, rtf, rwl, rx2, sbs, sn1, sna, spf, sr2, srf, srw, tbl, tib, tis, txt, wab, wps, wps, x3f, xls, xlsb, xlsk, xlsm, xlsx, zip.

This example encrypts files of the office applications (and, as Microsoft Office, and OpenOffice), files, images, databases files, cryptographic keys (EDS) files, the files of 1C: Enterprise and others.

Please be careful and do not click on links in emails from the unknown sources.

If you accidentally run the file, try as quickly as possible to complete the process mail.exe (using Task Manager - Ctrl + Alt + Del -> Start Task Manager). If you do it fast enough, you can reduce the amount of encrypted files.

After that (without restarting the computer, since after a reboot the malware starts automatically), you need to install an anti-virus utility of the computer check, which is installed without rebooting (for example, Kaspersky Virus Removal Tool, or Dr.Web CureIt!) and check your computer.

If you can not perform complex technical actions on the computer - after the completion of mail.exe consult technical experts (without shutting down and restarting your computer).

General tips on protecting data against cryptographers:

Be sure to use an antivirus program with current signatures database (updated databases).

At present time, more than 300 thd. new malicious objects appeared in a day in the world. Accordingly, if your databases are staled for one week - your antivirus software is unable to detect more than two million malicious objects (except those that it will be able to determine from the behavior).

To have current backup copies of your data - as the document file and the key databases and information systems (e.g. 1C: Enterprise and etc.).

These copies are stored separately from the operating system, on the removable disk, or on another machine, to which there is no access with rights to record from the host (so the malware could not encrypt data on a network drive, or connected removable drive).

The frequency of the backup copies should be selected according to the frequency of data changes and their values (for example, files of 1C: Enterprise desirably to copy every day).

Do not open (at least, on a computer that has access to real operational data) files, received by mail (or downloaded from the Internet) from untrusted sources.

Even if you trust the sender, unusual letter (an unexpected topic that was not discussed earlier, atypical for the sender) should alert you (could hack your account and send your colleague a malicious object on his behalf).

Special dangerous letters requiring urgent actions (to send urgently, coordinate, check), if they are received from unknown senders or not the appropriate context: no one told you of the need for urgent action by telephone or other means other than e-mail, but you get a letter with similar requirements.

If you are working with very important data, and can not ignore such letters (for example, you are processing incoming mail) - use a separate computer that is not connected to the production network to work with letters.

Recommendations for engineers maintaining the computers:

To disable on the proxy server of the Company an access to the website http://localstrip.com

Set on important computers security technologies based on default deny - this technology is implemented in a large number of anti-virus products.

Every manufacturer of anti-virus tools named this technology in different ways, if you can not find in the user manual (administrator) the information on setting up - Please contact Technical Support Service.

Of course, this technology imposes strict (though customizable) limitations, but it provides a high level of security for computers where processing the important information.

You can also configure the monitoring program (the name may change) so that an antivirus program has blocked attempts of untrusted software to change the files, which are important for you (by extension).

On any suspicious emails in your opinion, the pages on the Internet please report to a single short number 1400 or e-mail info@kz-cert.kz.