Warning: Russian hackers may be trying to target you with ransomware. Here’s how

Bank review, current USBR score and consumer report

Russian hackers are trying to take advantage of the millions of employees working from home because of shelter-in-place orders.

Security firm Symantec said this week that it had discovered and then notified businesses that the Russian hacking group Evil Corp has been targeting remote employees with so-called ransomware attacks.

In a typical ransomware attack, criminals send victims an email—often created to look like it’s from a colleague—that contains a link to a malicious site. When users access the fraudulent site, criminals can then take over their computers and demand payment—typically in cryptocurrency like Bitcoin—to regain control of their devices.

In the case of Evil Corp’s ransomware attack, Symantec said the hackers wanted to “cripple” a company’s “IT infrastructure by encrypting most of their computers and servers in order to demand a multimillion-dollar ransom.”

Symantec said that 31 U.S.-based organizations were compromised in the latest series of attacks, “eight of which are Fortune 500 companies.” The security firm did not reveal the names of the impacted organizations nor whether they paid any ransoms. The security firm said that while the hackers “breached the networks of targeted organizations,” the criminals were only “in the process of laying the groundwork for staging ransomware attacks,” implying that they didn’t complete their intended extortion plans. 

This recent hacking attempt used a specific type of ransomware known as WastedLocker, which Symantec said was developed by Evil Corp. Two of Evil Corp’s alleged members have been previously charged by the U.S. Department of Justice for a separate “decade-long cybercrime spree” affecting unspecified banks and financial firms, Symantec said.

Eric Chien, Symantec’s technical director, said in an interview with the New York Times, that hackers were able to launch ransomware attacks on workers via malware that “was deployed on common websites and even one news site,” without describing those compromised websites containing the malicious code. From those compromised websites, users inadvertently downloaded a bogus software update that installs the malware onto their computers.

That malware inspects people’s computers to see if they have installed a corporate virtual private network, or VPN, that businesses typically require their remote employees to use in order to access sensitive corporate data. The malware learns the name of the employee’s company from the VPN and is then able to infect people’s computers once those workers visit another website. 

“Once the machine is reconnected to the corporate network, the code is deployed, in hopes of gaining access to corporate systems,” the Times said.

More must-read tech coverage from Fortune:

11 Things You Should Know Before You Get Your First Credit Card

A credit card may seem like just another tool to help you make purchases, but it can be much more. When used responsibly, a credit card can help you build

What Is a Balance Transfer, and Should I Consider Doing One?

In a perfect world, no one would carry a balance on their credit card. We would all pay our bills in full each month and never have to worry about

How Is Credit Card Interest Calculated?

So your bank tells you that your credit card has a 15% APR. What does that actually mean? How does your bank calculate your interest rate, and how does that translate into how much you actually pay? …

What Is a Balance Transfer, and Should I Consider Doing One?

In a perfect world, no one would carry a balance on their credit card. We would all pay our bills in full each month and never have to worry about

Subscribe to our e-mail list and stay up-to-date with all our news.

The US Bank Review is an independent authority and bank watchdog group monitoring financial institutions operating the in United States. We have no affiliation with any banks featured, reviewed or profiled. All rights reserved. Terms of use and Privacy Policy