High-Risk Cryptolocker Ransomware Disguised as Turkcell Invoice

A recent trend observed by our PicusLabs team shows that Cryptolocker Ransomware virus is becoming a high-risk threat for enterprises from a variety of sectors. That said, this post is written to inform the readers about a new cyber-attack wave which started on June 30th.

This particular cyber-attack disguises itself in Turkcell's invoice information email format (Turkcell is the largest GSM operator in Turkey). The primary aim of this attack is to catch the user by surprise due to the very high invoice balance that needs to be paid as shown in the email. Instantly, the content hooks the user and urges him/her to click the fake payment link embedded in the email.

Victims who end up clicking the fake invoice payment link are being redirected to iturkcell.net and turkcell-efatura.com domains. These fake domains have user interfaces very similar to Turkcell's website and they request a security code input from everyone with an aim of reaching the invoice file. Obviously, downloaded invoice zip contains the Cryptolocker Ransomware infected file.

On July 2nd, 2015, we updated our Picus Cyber-Attack database with related attack vectors to assess Picus customers’ readiness against this particular threat. The threat comes with 4 domains containing the viral content and 2 variants of the Cryptolocker virus in ZIP and EXE.file formats.

At the moment, the installed Picus software on your security control systems contains the most up-to-date Cyber-Attack Database. What this means is that you can easily test your network security system's readiness to see whether they are immune to the most popular, high-risk cyber-threats including Cryptolocker. If you have not tried the Picus Platform yet, feel free to contact us to request a live Picus Demo. It takes only 2 hours before you see your network security system’s resilience in the face of Cryptolocker & 1000+ similar cyber-threats!

The main focus of the recent cyber-attack is the Cryptolocker Ransomware virus disguised as a Turkcell invoice, targeting users with fake invoice payment links to download ransomware-infected files.

The Cryptolocker Ransomware disguises itself as a Turkcell invoice email with a high invoice balance, urging users to click on a fake payment link that leads to malware-infected domains.

When victims click on the fake invoice payment link, they are redirected to fake domains similar to Turkcell's website, where they are asked to input a security code to access the invoice file, which actually contains the ransomware.

Users can test their network security's readiness against Cryptolocker by using the Picus Platform, which includes the most up-to-date Cyber-Attack Database and allows them to assess their systems' resilience against such threats.

If someone wants to try the Picus Platform, they should contact Picus to request a live demo, which takes only 2 hours to demonstrate the network security system's resilience against Cryptolocker and other cyber-threats.

The Cryptolocker virus is mentioned as being in ZIP and EXE file formats within the article.