The virus is called Varenyky and it’s a doozy. It’s apparently been designed to target customers of French ISP Orange SA, but the researchers indicate there’s nothing stopping someone from using the same malware on other ISPs or in other areas. It’s delivered via a very official looking email that appears to be a phone bill. Unsuspecting victims believe they’re opening a document that’s been protected and secured by Microsoft, when in reality they’re activating the virus and giving it permission to run macros in Word. According to a post on ESET’s website: Once active, the macro contained in the fake bill executes processes that allows the malware to download the additional files it needs to gather passwords, propagate to other systems, and record your screen. An English version of the email that victims would supposedly receive after their screens were recorded was posted earlier this year by ESET: Credit: ESET So how dangerous is it? The sextortion scam aspect of the malware doesn’t appear to be a major threat. ESET security expert Bruce P. Burrell said it’s likely the so-called hacker is using a “sextortion scam kit” they purchased on the dark web. To date, it doesn’t appear as though anyone’s been extorted by Varenyky in this method. But anyone who’s downloaded the fake bill and mistakenly given it permission to run macros is at very high risk of having their passwords and financial information stolen and spreading the malware to people in their contacts list. While Varenyky doesn’t appear to be a global threat yet, and so far there’s been no documented instances of it successfully extorting anyone, the simplicity of its attack vector is noteworthy. And, according to ESET, the malware’s developers are tenacious: In the meantime, security experts say the best defense against malware is to keep your OS and antivirus software up to date, and avoid opening email attachments or downloading files unless you’re 100-percent certain they’re not dangerous.
